Welcome to Script Monitoring Docs
Install one tag, decide on every third-party script your pages load, and keep the PCI DSS 6.4.3 and 11.6.1 evidence.
Every third-party script on your pages, scored against detection rules, with one decision per vendor.
A justified script inventory and header change detection for your payment pages, packed weekly.
Start by install method
One tag, first in the head of every page. Pick the method that fits your stack.
View all methodsStart by use case
Task guides and the pages behind them, grouped by what you need to get done.
View all guidesProve PCI DSS
Stop client-side attacks
API reference
The tag on your pages, the events Script Monitoring sends you, and the REST API for your backend.
View API reference<head><!-- First in the head of every page --><scripttype="text/javascript"src="https://<teamID>.cdn.scriptmt.com/sm.js"referrerpolicy="origin"></script></head>
Report received
- One tag per team, every domain
- Synchronous, before any other script
- Six install methods, same tag
What does Script Monitoring do?
Script Monitoring watches every third-party script that runs on your pages. You add one script tag to the <head> of your site, and from then on each script your visitors load is inventoried, grouped by the vendor that serves it, and checked against a catalog of detection rules. When a rule fires you get an alert with a risk score from 1 to 10, and you decide once per vendor: allow it, block the flagged scripts, or look again later.
The same data is your evidence for PCI DSS 4.0.1: a script inventory with a justification for each vendor (requirement 6.4.3), the security headers on your payment pages watched for changes (requirement 11.6.1), and a weekly evidence pack. These docs show you how to set it up and use it. For how it works under the hood, see How it works.
Where do I start?#
- QuickstartFrom install to a clean alert queue, step by step.
- Verify it's workingConfirm the tag is delivered and reporting.
- Payment pagesName the pages that take payment, for PCI DSS.
- Respond to a malicious scriptBlock it, check where it ran, remove the source.
Frequently asked questions
Which plans do these docs cover?
All of them. Each page shows the lowest plan that includes the feature it describes. Plans and prices are on the pricing page.
Is there a version of these docs for AI assistants?
Yes. Every page has a clean Markdown version: add .md to its URL, or use View as Markdown under the title. llms.txt lists every page and llms-full.txt has the full text in one file.
Where do I ask a question the docs don't answer?
Use the chat on this site or in the dashboard.