# Sitemap > Every page of the Script Monitoring docs on one page, grouped by tab and section, with a one-line summary of what each page covers. Source: https://docs.scriptmonitoring.com/sitemap/ ยท Updated 2026-10-14 Every page of these docs, in the same order as the sidebar. Start at the [docs home](https://docs.scriptmonitoring.com/) or the [Quickstart](https://docs.scriptmonitoring.com/quickstart/) if you are new. ## Get started ### Get started - [Quickstart](https://docs.scriptmonitoring.com/quickstart/): The shortest path to a working install: answer Setup steps 1 and 2, add the tag from step 3, load a page and confirm it reports in step 5. - [Install the script tag](https://docs.scriptmonitoring.com/install/): Add the Script Monitoring tag to your site. Copy your snippet from Setup step 3, pick a method and place the tag first in the head. - [Install with an HTML script tag](https://docs.scriptmonitoring.com/install/html/): Paste the Script Monitoring script tag at the top of your site's head. Copy the snippet from Setup step 3, keep it synchronous, and add it to every page. - [Install with Google Tag Manager](https://docs.scriptmonitoring.com/install/google-tag-manager/): Add the Script Monitoring tag as a GTM Custom HTML tag on All Pages to test it quickly. For production, install the tag directly in the head. - [Install in a Next.js app](https://docs.scriptmonitoring.com/install/nextjs/): Install @scriptmonitoring/next and render ScriptMonitoringScript in pages/_document.tsx or your root layout, so the tag loads first on every page. - [Install with the Vite plugin](https://docs.scriptmonitoring.com/install/vite/): Install @scriptmonitoring/vite and register scriptMonitoring() in vite.config.ts. Every production build gets the tag first in the head. - [Install with the CLI](https://docs.scriptmonitoring.com/install/cli/): Run npx @scriptmonitoring/cli after your build to inject the Script Monitoring tag into every static HTML file. Works for dist and .next output and in CI. - [Install with an AI coding assistant](https://docs.scriptmonitoring.com/install/ai-assistant/): Paste one prompt into Claude Code, Cursor or GitHub Copilot. It fetches the Script Monitoring setup guide and installs the tag with your script URL. - [Verify it's working](https://docs.scriptmonitoring.com/verify/): Check that the Script Monitoring tag is delivered and reporting: read Setup step 5, Verify, its tiles, per-domain list and status notes. - [Payment pages](https://docs.scriptmonitoring.com/payment-pages/): Tell Script Monitoring which pages take payment with selectors in Setup step 4, test a real checkout URL, and choose whether only payment pages report. - [CSP reporting](https://docs.scriptmonitoring.com/csp-reporting/): Send Content Security Policy violation reports to Script Monitoring. Add the headers from the CSP setup sheet, then run the header check. - [Glossary](https://docs.scriptmonitoring.com/glossary/): Short definitions of the client-side security and PCI DSS terms used in these docs, from Magecart and CSP to requirements 6.4.3 and 11.6.1. ## Guides ### Get value - [Your first week](https://docs.scriptmonitoring.com/guides/first-week/): A day-by-day plan after install: set payment pages and CSP, clear the alert queue, decide on every vendor, then turn on notifications and invite your team. - [Triage alerts](https://docs.scriptmonitoring.com/guides/triage-alerts/): Clear the Alerts queue one vendor at a time: start with Needs action, open each decision, then Allow, Block or choose Not now. Keyboard shortcuts included. ### Stop attacks - [Respond to a malicious script](https://docs.scriptmonitoring.com/guides/malicious-script/): What to do when Script Monitoring flags a malicious script: block it at the edge, check which pages it ran on, confirm the block and remove the source. ### Govern vendors - [Approve or block a vendor](https://docs.scriptmonitoring.com/guides/approve-or-block-a-vendor/): Review a vendor on the Vendors page, read its score, pages and PCI DSS status, then Allow it as approved or Block every resource it serves. ### Prove PCI DSS - [Prepare PCI DSS evidence](https://docs.scriptmonitoring.com/guides/pci-dss-evidence/): Get assessor-ready evidence from Script Monitoring: justify payment-page vendors, check header changes and generate the weekly report. ### Stay informed - [Set up notifications](https://docs.scriptmonitoring.com/guides/notifications/): Edit or add a notification rule, choose its trigger, domains and destinations (email, webhook or S3), then send a test to check it arrives. ## Dashboard ### Overview - [Home](https://docs.scriptmonitoring.com/home/): Reference for the dashboard Home page: the critical alert banner, the seven tiles, high-risk vulnerabilities and top risks, and what each number links to. ### Security - [Domains](https://docs.scriptmonitoring.com/domains/): Reference for Security > Domains: the columns and reporting statuses, the Add domain sheet, Script tag or Agentic crawler, and who can add or remove domains. - [Alerts](https://docs.scriptmonitoring.com/alerts/): Reference for Security > Alerts: how decisions are grouped, the 1 to 10 risk score and its bands, what Allow, Block and Not now do, and who can act. - [Blocks](https://docs.scriptmonitoring.com/blocks/): Stop a script at the Script Monitoring edge on every domain in your team, check the rule is enforced, and respond to a malicious script step by step. - [Approved tags](https://docs.scriptmonitoring.com/approved-tags/): Reference for Security > Approved tags: approve the Google Tag Manager containers your site may load, and every other container is blocked before it runs. - [Vendors](https://docs.scriptmonitoring.com/vendors/): Reference for Security > Vendors: vendor statuses, what the details sheet shows, what Allow and Block do, the pinned rows and the Pro features. - [CSP violations](https://docs.scriptmonitoring.com/csp-violations/): Reference for Security > CSP violations: the weekly violation table and its columns, the directive filters, monthly report limits and the CSV export. ### Compliance - [PCI DSS 6.4.3 & 11.6.1](https://docs.scriptmonitoring.com/pci-dss/): Reference for Compliance > PCI DSS 6.4.3 & 11.6.1: the Vendors, Headers, Reports and Payment pages monitored tabs, their statuses and the evidence pack. ### Developers - [Setup](https://docs.scriptmonitoring.com/setup/): Reference for Developers > Setup: the five steps (Use case, Site type, Install, Scope, Verify), what each asks and why, and who can change them. - [Diagnostics](https://docs.scriptmonitoring.com/diagnostics/): Use Diagnostics to see whether each domain's Scripts, CSP Violations and Security Headers streams are receiving data, and stop false alarms on quiet sites. - [API keys](https://docs.scriptmonitoring.com/api-keys/): Reference for Developers > API keys: sm_org_ and sm_team_ key formats, the scopes each key can carry, creating and revoking keys, and who manages them. - [Emergency stop](https://docs.scriptmonitoring.com/emergency-stop/): Reference for Developers > Emergency stop: pause or resume Script Monitoring for a team, who can do it, and what keeps running while it is on. ### Account - [Usage](https://docs.scriptmonitoring.com/usage/): Reference for Account > Usage: page views this month, plan utilization, the month-end projection, daily page views and the split by domain. - [Plans and upgrades](https://docs.scriptmonitoring.com/plans/): What Free, Pro and Enterprise include, how page views are metered, the 14-day Pro trial, the plan sheet, and how to request an Enterprise proof of concept. ### Settings - [Organization](https://docs.scriptmonitoring.com/organization/): Reference for Settings > Organization: the name, ID, primary contact and data retention, plus single sign-on, required MFA and the audit log. - [Teams](https://docs.scriptmonitoring.com/teams/): Reference for Settings > Teams: every team in the organization with your role, its domains and open alerts, how to switch teams, and who can add one. - [Members](https://docs.scriptmonitoring.com/members/): Reference for Settings > Members: the Super admin, Admin and Viewer roles, team access, MFA status, invitations, and who can change access. - [Single sign-on (SSO)](https://docs.scriptmonitoring.com/sso/): Reference for single sign-on: where to configure it, the Okta, Duo, Microsoft Entra ID and SAML 2.0 fields, how people sign in, and who can change it. - [Multi-factor authentication (MFA)](https://docs.scriptmonitoring.com/mfa/): Reference for MFA: authenticator apps, passkeys and backup codes in Profile, and requiring MFA for the organization or single teams, with Banner or Lockout. - [Audit logs](https://docs.scriptmonitoring.com/audit-logs/): Reference for Settings > Audit logs: the columns, the scope, kind of change and person filters, which changes are recorded, and who sees which entries. - [Notifications](https://docs.scriptmonitoring.com/notifications/): Reference for Settings > Notifications: every rule and when it fires, the defaults per use case, destinations and plan limits, and your own email preferences. - [Billing](https://docs.scriptmonitoring.com/billing/): Reference for Settings > Billing: the team's plan card and its statuses, the organization's payment method, invoices, and who can change each. - [Profile](https://docs.scriptmonitoring.com/profile/): Reference for Settings > Profile: your name, email, role, password, two-factor methods, active sessions, and how to delete your account. - [Appearance](https://docs.scriptmonitoring.com/appearance/): Reference for Settings > Appearance: the Light, Dark and System themes and the Comfortable and Compact row densities, saved for this browser only. ## API ### REST API - [REST API](https://docs.scriptmonitoring.com/api/): Manage teams, domains and payment pages from your backend with the Script Monitoring REST API: base URL, API keys and scopes, rate limit, paging and errors. ### Teams - [List teams](https://docs.scriptmonitoring.com/api/teams/list/): GET /v1/teams lists the teams in your organization with their ID, name, creation date and suspension state. Needs an organization API key. - [Create a team](https://docs.scriptmonitoring.com/api/teams/create/): POST /v1/teams creates a team in your organization and returns its ID. Needs an organization key with teams:create, on Pro or Enterprise. - [Delete a team](https://docs.scriptmonitoring.com/api/teams/delete/): DELETE /v1/teams deletes a team and its domains by team ID. Needs an organization key with teams:delete; a team with a subscription can't be deleted. ### Domains - [List domains](https://docs.scriptmonitoring.com/api/domains/list/): GET /v1/domains returns your registered domains with their team, Script tag or Agentic crawler mode, wildcard and suspension state, page by page. - [Register domains](https://docs.scriptmonitoring.com/api/domains/create/): POST /v1/domains registers up to 100 domains in a team in one call and reports, per domain, whether it was created, already existed or was invalid. - [Delete domains](https://docs.scriptmonitoring.com/api/domains/delete/): DELETE /v1/domains removes up to 100 domains from a team by domain ID and reports, per ID, whether it was deleted or not found. ### Payment pages - [Add a payment page](https://docs.scriptmonitoring.com/api/payment-pages/create/): POST /v1/payment-pages adds one payment page selector to a team, the same selectors you manage in Setup step 4, and says whether it was new. ### Events - [Webhooks](https://docs.scriptmonitoring.com/webhooks/): Receive Script Monitoring alerts on your own URL. Verify the x-scriptmonitoring-signature HMAC-SHA256 header and read the alert.created JSON payload. ## For machines - [sitemap.xml](https://docs.scriptmonitoring.com/sitemap.xml): every page with its last change date, screenshots and flow videos, for search engines. - [llms.txt](https://docs.scriptmonitoring.com/llms.txt): a short index of every page for AI assistants, linking each page's Markdown copy. - [llms-full.txt](https://docs.scriptmonitoring.com/llms-full.txt): the full text of every page in one file. - Any page as Markdown: add `.md` to its address, for example [/quickstart.md](https://docs.scriptmonitoring.com/quickstart.md).