# Script Monitoring docs > How to install, configure and use Script Monitoring: the client-side security product that inventories the third-party scripts on your pages, scores them against detection rules, blocks the ones you decide to block, and produces evidence for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. What the product is, pricing and comparisons are on https://www.scriptmonitoring.com. - Every page has a clean Markdown version: add `.md` to its path (the home page is https://docs.scriptmonitoring.com/index.md). - Every page in one file: https://docs.scriptmonitoring.com/llms-full.txt - Setup guide for AI coding assistants: https://docs.scriptmonitoring.com/ai-setup.md - The install snippet is team-specific. It goes first in the ``: ``. The dashboard (Developers > Setup, step 3) fills in the team ID. ## Home - [Script Monitoring documentation](https://docs.scriptmonitoring.com/index.md): Install the Script Monitoring tag, triage alerts, approve or block vendors, and collect PCI DSS 6.4.3 and 11.6.1 evidence. Guides and reference. ## Get started - [Quickstart](https://docs.scriptmonitoring.com/quickstart.md): The shortest path to a working install: answer Setup steps 1 and 2, add the tag from step 3, load a page and confirm it reports in step 5. - [Install the script tag](https://docs.scriptmonitoring.com/install.md): Add the Script Monitoring tag to your site. Copy your snippet from Setup step 3, pick a method and place the tag first in the head. - [Install with an HTML script tag](https://docs.scriptmonitoring.com/install/html.md): Paste the Script Monitoring script tag at the top of your site's head. Copy the snippet from Setup step 3, keep it synchronous, and add it to every page. - [Install with Google Tag Manager](https://docs.scriptmonitoring.com/install/google-tag-manager.md): Add the Script Monitoring tag as a GTM Custom HTML tag on All Pages to test it quickly. For production, install the tag directly in the head. - [Install in a Next.js app](https://docs.scriptmonitoring.com/install/nextjs.md): Install @scriptmonitoring/next and render ScriptMonitoringScript in pages/_document.tsx or your root layout, so the tag loads first on every page. - [Install with the Vite plugin](https://docs.scriptmonitoring.com/install/vite.md): Install @scriptmonitoring/vite and register scriptMonitoring() in vite.config.ts. Every production build gets the tag first in the head. - [Install with the CLI](https://docs.scriptmonitoring.com/install/cli.md): Run npx @scriptmonitoring/cli after your build to inject the Script Monitoring tag into every static HTML file. Works for dist and .next output and in CI. - [Install with an AI coding assistant](https://docs.scriptmonitoring.com/install/ai-assistant.md): Paste one prompt into Claude Code, Cursor or GitHub Copilot. It fetches the Script Monitoring setup guide and installs the tag with your script URL. - [Verify it's working](https://docs.scriptmonitoring.com/verify.md): Check that the Script Monitoring tag is delivered and reporting: read Setup step 5, Verify, its tiles, per-domain list and status notes. - [Payment pages](https://docs.scriptmonitoring.com/payment-pages.md): Tell Script Monitoring which pages take payment with selectors in Setup step 4, test a real checkout URL, and choose whether only payment pages report. - [CSP reporting](https://docs.scriptmonitoring.com/csp-reporting.md): Send Content Security Policy violation reports to Script Monitoring. Add the headers from the CSP setup sheet, then run the header check. ## Get value - [Your first week](https://docs.scriptmonitoring.com/guides/first-week.md): A day-by-day plan after install: set payment pages and CSP, clear the alert queue, decide on every vendor, then turn on notifications and invite your team. - [Triage alerts](https://docs.scriptmonitoring.com/guides/triage-alerts.md): Clear the Alerts queue one vendor at a time: start with Needs action, open each decision, then Allow, Block or choose Not now. Keyboard shortcuts included. ## Stop attacks - [Respond to a malicious script](https://docs.scriptmonitoring.com/guides/malicious-script.md): What to do when Script Monitoring flags a malicious script: block it at the edge, check which pages it ran on, confirm the block and remove the source. ## Govern vendors - [Approve or block a vendor](https://docs.scriptmonitoring.com/guides/approve-or-block-a-vendor.md): Review a vendor on the Vendors page, read its score, pages and PCI DSS status, then Allow it as approved or Block every resource it serves. ## Prove PCI DSS - [Prepare PCI DSS evidence](https://docs.scriptmonitoring.com/guides/pci-dss-evidence.md): Get assessor-ready evidence from Script Monitoring: justify payment-page vendors, check header changes and generate the weekly report. ## Stay informed - [Set up notifications](https://docs.scriptmonitoring.com/guides/notifications.md): Edit or add a notification rule, choose its trigger, domains and destinations (email, webhook or S3), then send a test to check it arrives. ## Overview - [Home](https://docs.scriptmonitoring.com/home.md): Reference for the dashboard Home page: the critical alert banner, the seven tiles, high-risk vulnerabilities and top risks, and what each number links to. ## Security - [Domains](https://docs.scriptmonitoring.com/domains.md): Reference for Security > Domains: the columns and reporting statuses, the Add domain sheet, Script tag or Agentic crawler, and who can add or remove domains. - [Alerts](https://docs.scriptmonitoring.com/alerts.md): Reference for Security > Alerts: how decisions are grouped, the 1 to 10 risk score and its bands, what Allow, Block and Not now do, and who can act. - [Blocks](https://docs.scriptmonitoring.com/blocks.md): Stop a script at the Script Monitoring edge on every domain in your team, check the rule is enforced, and respond to a malicious script step by step. - [Approved tags](https://docs.scriptmonitoring.com/approved-tags.md): Reference for Security > Approved tags: approve the Google Tag Manager containers your site may load, and every other container is blocked before it runs. - [Vendors](https://docs.scriptmonitoring.com/vendors.md): Reference for Security > Vendors: vendor statuses, what the details sheet shows, what Allow and Block do, the pinned rows and the Pro features. - [CSP violations](https://docs.scriptmonitoring.com/csp-violations.md): Reference for Security > CSP violations: the weekly violation table and its columns, the directive filters, monthly report limits and the CSV export. ## Compliance - [PCI DSS 6.4.3 & 11.6.1](https://docs.scriptmonitoring.com/pci-dss.md): Reference for Compliance > PCI DSS 6.4.3 & 11.6.1: the Vendors, Headers, Reports and Payment pages monitored tabs, their statuses and the evidence pack. ## Developers - [Setup](https://docs.scriptmonitoring.com/setup.md): Reference for Developers > Setup: the five steps (Use case, Site type, Install, Scope, Verify), what each asks and why, and who can change them. - [Diagnostics](https://docs.scriptmonitoring.com/diagnostics.md): Use Diagnostics to see whether each domain's Scripts, CSP Violations and Security Headers streams are receiving data, and stop false alarms on quiet sites. - [API keys](https://docs.scriptmonitoring.com/api-keys.md): Reference for Developers > API keys: sm_org_ and sm_team_ key formats, the scopes each key can carry, creating and revoking keys, and who manages them. - [Emergency stop](https://docs.scriptmonitoring.com/emergency-stop.md): Reference for Developers > Emergency stop: pause or resume Script Monitoring for a team, who can do it, and what keeps running while it is on. ## Account - [Usage](https://docs.scriptmonitoring.com/usage.md): Reference for Account > Usage: page views this month, plan utilization, the month-end projection, daily page views and the split by domain. - [Plans and upgrades](https://docs.scriptmonitoring.com/plans.md): What Free, Pro and Enterprise include, how page views are metered, the 14-day Pro trial, the plan sheet, and how to request an Enterprise proof of concept. ## Settings - [Organization](https://docs.scriptmonitoring.com/organization.md): Reference for Settings > Organization: the name, ID, primary contact and data retention, plus single sign-on, required MFA and the audit log. - [Teams](https://docs.scriptmonitoring.com/teams.md): Reference for Settings > Teams: every team in the organization with your role, its domains and open alerts, how to switch teams, and who can add one. - [Members](https://docs.scriptmonitoring.com/members.md): Reference for Settings > Members: the Super admin, Admin and Viewer roles, team access, MFA status, invitations, and who can change access. - [Single sign-on (SSO)](https://docs.scriptmonitoring.com/sso.md): Reference for single sign-on: where to configure it, the Okta, Duo, Microsoft Entra ID and SAML 2.0 fields, how people sign in, and who can change it. - [Multi-factor authentication (MFA)](https://docs.scriptmonitoring.com/mfa.md): Reference for MFA: authenticator apps, passkeys and backup codes in Profile, and requiring MFA for the organization or single teams, with Banner or Lockout. - [Audit logs](https://docs.scriptmonitoring.com/audit-logs.md): Reference for Settings > Audit logs: the columns, the scope, kind of change and person filters, which changes are recorded, and who sees which entries. - [Notifications](https://docs.scriptmonitoring.com/notifications.md): Reference for Settings > Notifications: every rule and when it fires, the defaults per use case, destinations and plan limits, and your own email preferences. - [Billing](https://docs.scriptmonitoring.com/billing.md): Reference for Settings > Billing: the team's plan card and its statuses, the organization's payment method, invoices, and who can change each. - [Profile](https://docs.scriptmonitoring.com/profile.md): Reference for Settings > Profile: your name, email, role, password, two-factor methods, active sessions, and how to delete your account. - [Appearance](https://docs.scriptmonitoring.com/appearance.md): Reference for Settings > Appearance: the Light, Dark and System themes and the Comfortable and Compact row densities, saved for this browser only. ## REST API - [REST API](https://docs.scriptmonitoring.com/api.md): Manage teams, domains and payment pages from your backend with the Script Monitoring REST API: base URL, API keys and scopes, rate limit, paging and errors. ## Teams - [List teams](https://docs.scriptmonitoring.com/api/teams/list.md): GET /v1/teams lists the teams in your organization with their ID, name, creation date and suspension state. Needs an organization API key. - [Create a team](https://docs.scriptmonitoring.com/api/teams/create.md): POST /v1/teams creates a team in your organization and returns its ID. Needs an organization key with teams:create, on Pro or Enterprise. - [Delete a team](https://docs.scriptmonitoring.com/api/teams/delete.md): DELETE /v1/teams deletes a team and its domains by team ID. Needs an organization key with teams:delete; a team with a subscription can't be deleted. ## Domains - [List domains](https://docs.scriptmonitoring.com/api/domains/list.md): GET /v1/domains returns your registered domains with their team, Script tag or Agentic crawler mode, wildcard and suspension state, page by page. - [Register domains](https://docs.scriptmonitoring.com/api/domains/create.md): POST /v1/domains registers up to 100 domains in a team in one call and reports, per domain, whether it was created, already existed or was invalid. - [Delete domains](https://docs.scriptmonitoring.com/api/domains/delete.md): DELETE /v1/domains removes up to 100 domains from a team by domain ID and reports, per ID, whether it was deleted or not found. ## Payment pages - [Add a payment page](https://docs.scriptmonitoring.com/api/payment-pages/create.md): POST /v1/payment-pages adds one payment page selector to a team, the same selectors you manage in Setup step 4, and says whether it was new. ## Events - [Webhooks](https://docs.scriptmonitoring.com/webhooks.md): Receive Script Monitoring alerts on your own URL. Verify the x-scriptmonitoring-signature HMAC-SHA256 header and read the alert.created JSON payload. ## Optional - [Script Monitoring](https://www.scriptmonitoring.com/llms.txt): the product site's llms.txt (what it is, pricing, comparisons) - [Sitemap](https://docs.scriptmonitoring.com/sitemap.xml)