# Respond to a malicious script

> What to do when Script Monitoring flags a malicious script: block it at the edge, check which pages it ran on, confirm the block and remove the source.

Source: https://docs.scriptmonitoring.com/guides/malicious-script/ · Plan: All plans · Updated 2026-10-13

When Script Monitoring flags a malicious script, block it first and investigate second. A block from the alert stops the flagged scripts on every domain in your team in under 60 seconds, at the Script Monitoring edge, without a deploy on your side. Each step below links to the page that explains it.

![The review sheet for n0rthwind.com: 10.0 Critical, why it scored 10.0 (Payment Skimmer, Script Monitoring Watchlist Match, Keylogger or Form Data Stealer), the load chain through Google Tag Manager, the PCI DSS 4.0.1 compliance gap and the pages it was seen on, with Not now, Allow and Block.](https://docs.scriptmonitoring.com/screenshots/alert-review-sheet-light.webp)

## Step 1: block it from the alert

Open **Security > Alerts**, click **Critical** and open the decision. Read what happened and the script URL, then click **Block** and **Block now**. How the score and the three actions work: [Alerts](https://docs.scriptmonitoring.com/alerts/).

## Step 2: check where it ran

Open the vendor's details from the alert or from **Security > Vendors**. **Seen pages** marks each page as **Payment page** or **Not a payment page**, and the **PCI DSS 4.0.1** section says whether it ran in scope: [Vendors](https://docs.scriptmonitoring.com/vendors/).

## Step 3: confirm the block

On **Security > Blocks**, the rule says **Blocking** once it has stopped a request: [Blocks](https://docs.scriptmonitoring.com/blocks/).

## Step 4: remove the source

A block stops the script from loading through Script Monitoring. Also remove the cause from your site: the tag, the compromised dependency or the tag manager entry that injects it. Keep the block until you are sure the source is gone, then lift it from **Security > Blocks**.

## Frequently asked questions

### What if the script has no alert?

Add a block rule yourself on **Security > Blocks** with **Block a script**: see [Blocks](https://docs.scriptmonitoring.com/blocks/).

### Who needs to know?

If the script ran on a payment page, involve whoever owns your PCI DSS incident response. The **Malicious script detected** notification can alert your team as soon as the rule fires: see [Notifications](https://docs.scriptmonitoring.com/notifications/).

## Related

- [Alerts](https://docs.scriptmonitoring.com/alerts/)
- [Blocks](https://docs.scriptmonitoring.com/blocks/)
- [Vendors](https://docs.scriptmonitoring.com/vendors/)