--- schema_version: "1" id: bdbd93953f96aa137945ab9151ff6e1d11faf287e9d134ede8c120c5c4d9017b title: Configure a Page Shield Policy for an eCDN Zone collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_eCDN_page_shield_policy.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_eCDN_page_shield_policy.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: bf6ce82c876bf2f55cf4511eb91ef0c633f333fedb0430433a21038e4bec82f3 description: Set up a Page Shield policy to make sure only trusted scripts run on sensitive store pages like cart and checkout. A Page Shield policy helps detect client-side script changes and supply chain risks, and helps your B2C Commerce store comply with the Payment Card Industry Data Security Standard (PCI DSS) 4.0.1 client-side security requirements. products: - Commerce - B2C Commerce release: "264" --- # Configure a Page Shield Policy for an eCDN Zone Set up a Page Shield policy to make sure only trusted scripts run on sensitive store pages like cart and checkout. A Page Shield policy helps detect client-side script changes and supply chain risks, and helps your B2C Commerce store comply with the Payment Card Industry Data Security Standard (PCI DSS) 4.0.1 client-side security requirements. You can configure up to 5 Page Shield policies per zone. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Page Shield isn't available on SCAPI zones. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) Page Shield policies help detect client-side script changes and potential supply chain risks on storefront pages. These controls are frequently used to support PCI DSS 4.0.1 client-side security monitoring requirements. The Page Shield Policies tab is part of the Configure Zone screen; for the full set of zone security controls, see [eCDN Zone Security Rules](https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_security_rules.htm&release=264.0.0&type=5 "Use the Security Rules tab on the Configure Zone screen to protect a B2C Commerce embedded CDN (eCDN) zone with web application firewall (WAF) managed rulesets, realm and zone security rules, custom firewall rules, and rate limiting. Learn what each control does, which zone types are eligible, and how traffic from trusted sources bypasses security checks."). 1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Locate the zone you want to configure, and select **Configure Zone** from the dropdown menu. ![Configure Zone dropdown menu for a Proxy Zone in Business Manager](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_configure_zone.png) 3. Select the Page Shield Policies tab, and then select **New Policy**. To switch to a different zone from this tab, select another name from the Zone dropdown menu. ![Page Shield Policies tab in Business Manager Embedded CDN Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_page_shield_policy_tab.png) 4. Enter a policy name. For example, "PCI Policy for Payments.” 5. (Optional) If you want the policy to be active when you save it, select **Enable Policy Upon Saving**. If you’re not ready to activate the policy yet, create it first, and then when you’re ready, return to the Page Shield Policies tab and enable your policy from the list. 6. Enter a policy expression using the visual dropdown interface to select a field, operator, and value. To add conditional logic, use the **And** or **Or** buttons. To manually enter the expression, click **Edit Expression**. For example, create an expression that targets a particular set of pages with payment scripts: 1. From the Field dropdown menu, select **URI Path** 2. From the Operator dropdown menu, select **Equals**. 3. For the Value field, enter a page name. For example, `/checkout` or `/cart`. 4. Select **Or**. 5. For the new expression, repeat steps a through c for any other pages where you have payment scripts. ![New Page Shield Policy in Business Manager Embedded CDN Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_page_shield_policy_expression.png) 7. Select any trusted scripts from the list of detected scripts. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note When allowing inline scripts to execute, you have two main options. Use a nonce (number used once) or unsafe-inline. Here’s a quick overview to help you decide: - Nonce is ‌effective against user-generated cross-site scripting (XSS) attacks, especially in older tech stacks. Modern stacks often have built-in protections. However, nonce doesn't protect against rogue code from GTM containers. - Unsafe-inline provides similar protection to nonce in this context, given the low XSS risk on payment pages where user-generated content (UGC) isn’t present. - Limit dependencies on payment pages to align with PCI DSS goals. Use unsafe-inline and, if necessary, unsafe-eval, with allow-listing of third-party dependencies for continuous monitoring and alerting. Or, continue using nonce and implement Page Shield for site-wide monitoring and alerting to meet PCI DSS requirements. 8. From the Action dropdown menu, select **Log** or **Allow**. 1. Log: Log any resources not covered by the policy, without blocking any resources. Use this action to validate a new policy before deploying it. Policy violation logs report any resources not covered by the policy. 2. Allow: Block any resources not explicitly allowed by the policy. Use the Allow action after validating a new policy with the Log action. Policies with the Allow action log policy violations for any blocked resource. 9. Click **Save**. B2C Commerce integrates all policy additions and violations with the [Log Center](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-pci-4-compliance.html#view-violation-logs), establishing a clear audit trail as required by PCI. View logs of who added policies and see violation logs when untrusted scripts attempt to run on protected pages To set up Page Shield notifications, use the [CDN Zones API](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-pci-4-compliance.html#step-3-set-up-notifications-and-view-violation-logs). #### See Also - [B2C Commerce Security Model](https://help.salesforce.com/s/articleView?id=cc.b2c_commerce_security_model.htm&release=264.0.0&type=5 "Salesforce B2C Commerce security is a partnership between Salesforce and our B2C Commerce customers. As always, Trust is our #1 value at Salesforce. We’re committed to delivering the highest standard in system availability, performance, and security.")