Sitemap

Get started

• QuickstartThe shortest path to a working install: answer Setup steps 1 and 2, add the tag from step 3, load a page and confirm it reports in step 5.
• Install the script tagAdd the Script Monitoring tag to your site. Copy your snippet from Setup step 3, pick a method and place the tag first in the head.
  • Install with an HTML script tagPaste the Script Monitoring script tag at the top of your site's head. Copy the snippet from Setup step 3, keep it synchronous, and add it to every page.
  • Install with Google Tag ManagerAdd the Script Monitoring tag as a GTM Custom HTML tag on All Pages to test it quickly. For production, install the tag directly in the head.
  • Install in a Next.js appInstall @scriptmonitoring/next and render ScriptMonitoringScript in pages/_document.tsx or your root layout, so the tag loads first on every page.
  • Install with the Vite pluginInstall @scriptmonitoring/vite and register scriptMonitoring() in vite.config.ts. Every production build gets the tag first in the head.
  • Install with the CLIRun npx @scriptmonitoring/cli after your build to inject the Script Monitoring tag into every static HTML file. Works for dist and .next output and in CI.
  • Install with an AI coding assistantPaste one prompt into Claude Code, Cursor or GitHub Copilot. It fetches the Script Monitoring setup guide and installs the tag with your script URL.
• Verify it's workingCheck that the Script Monitoring tag is delivered and reporting: read Setup step 5, Verify, its tiles, per-domain list and status notes.
• Payment pagesTell Script Monitoring which pages take payment with selectors in Setup step 4, test a real checkout URL, and choose whether only payment pages report.
• CSP reportingSend Content Security Policy violation reports to Script Monitoring. Add the headers from the CSP setup sheet, then run the header check.
• GlossaryShort definitions of the client-side security and PCI DSS terms used in these docs, from Magecart and CSP to requirements 6.4.3 and 11.6.1.

Get value

• Your first weekA day-by-day plan after install: set payment pages and CSP, clear the alert queue, decide on every vendor, then turn on notifications and invite your team.
• Triage alertsClear the Alerts queue one vendor at a time: start with Needs action, open each decision, then Allow, Block or choose Not now. Keyboard shortcuts included.

Stop attacks

• Respond to a malicious scriptWhat to do when Script Monitoring flags a malicious script: block it at the edge, check which pages it ran on, confirm the block and remove the source.

Govern vendors

• Approve or block a vendorReview a vendor on the Vendors page, read its score, pages and PCI DSS status, then Allow it as approved or Block every resource it serves.

Prove PCI DSS

• Prepare PCI DSS evidenceGet assessor-ready evidence from Script Monitoring: justify payment-page vendors, check header changes and generate the weekly report.

Stay informed

• Set up notificationsEdit or add a notification rule, choose its trigger, domains and destinations (email, webhook or S3), then send a test to check it arrives.

Overview

• HomeReference for the dashboard Home page: the critical alert banner, the seven tiles, high-risk vulnerabilities and top risks, and what each number links to.

Security

• DomainsReference for Security > Domains: the columns and reporting statuses, the Add domain sheet, Script tag or Agentic crawler, and who can add or remove domains.
• AlertsReference for Security > Alerts: how decisions are grouped, the 1 to 10 risk score and its bands, what Allow, Block and Not now do, and who can act.
• BlocksStop a script at the Script Monitoring edge on every domain in your team, check the rule is enforced, and respond to a malicious script step by step.
• Approved tagsReference for Security > Approved tags: approve the Google Tag Manager containers your site may load, and every other container is blocked before it runs.
• VendorsReference for Security > Vendors: vendor statuses, what the details sheet shows, what Allow and Block do, the pinned rows and the Pro features.
• CSP violationsReference for Security > CSP violations: the weekly violation table and its columns, the directive filters, monthly report limits and the CSV export.

Compliance

• PCI DSS 6.4.3 & 11.6.1Reference for Compliance > PCI DSS 6.4.3 & 11.6.1: the Vendors, Headers, Reports and Payment pages monitored tabs, their statuses and the evidence pack.

Developers

• SetupReference for Developers > Setup: the five steps (Use case, Site type, Install, Scope, Verify), what each asks and why, and who can change them.
• DiagnosticsUse Diagnostics to see whether each domain's Scripts, CSP Violations and Security Headers streams are receiving data, and stop false alarms on quiet sites.
• API keysReference for Developers > API keys: sm_org_ and sm_team_ key formats, the scopes each key can carry, creating and revoking keys, and who manages them.
• Emergency stopReference for Developers > Emergency stop: pause or resume Script Monitoring for a team, who can do it, and what keeps running while it is on.

Account

• UsageReference for Account > Usage: page views this month, plan utilization, the month-end projection, daily page views and the split by domain.
• Plans and upgradesWhat Free, Pro and Enterprise include, how page views are metered, the 14-day Pro trial, the plan sheet, and how to request an Enterprise proof of concept.

Settings

• OrganizationReference for Settings > Organization: the name, ID, primary contact and data retention, plus single sign-on, required MFA and the audit log.
• TeamsReference for Settings > Teams: every team in the organization with your role, its domains and open alerts, how to switch teams, and who can add one.
• MembersReference for Settings > Members: the Super admin, Admin and Viewer roles, team access, MFA status, invitations, and who can change access.
• Single sign-on (SSO)Reference for single sign-on: where to configure it, the Okta, Duo, Microsoft Entra ID and SAML 2.0 fields, how people sign in, and who can change it.
• Multi-factor authentication (MFA)Reference for MFA: authenticator apps, passkeys and backup codes in Profile, and requiring MFA for the organization or single teams, with Banner or Lockout.
• Audit logsReference for Settings > Audit logs: the columns, the scope, kind of change and person filters, which changes are recorded, and who sees which entries.
• NotificationsReference for Settings > Notifications: every rule and when it fires, the defaults per use case, destinations and plan limits, and your own email preferences.
• BillingReference for Settings > Billing: the team's plan card and its statuses, the organization's payment method, invoices, and who can change each.
• ProfileReference for Settings > Profile: your name, email, role, password, two-factor methods, active sessions, and how to delete your account.
• AppearanceReference for Settings > Appearance: the Light, Dark and System themes and the Comfortable and Compact row densities, saved for this browser only.

REST API

• REST APIManage teams, domains and payment pages from your backend with the Script Monitoring REST API: base URL, API keys and scopes, rate limit, paging and errors.

Teams

• List teamsGET /v1/teams lists the teams in your organization with their ID, name, creation date and suspension state. Needs an organization API key.
• Create a teamPOST /v1/teams creates a team in your organization and returns its ID. Needs an organization key with teams:create, on Pro or Enterprise.
• Delete a teamDELETE /v1/teams deletes a team and its domains by team ID. Needs an organization key with teams:delete; a team with a subscription can't be deleted.

Domains

• List domainsGET /v1/domains returns your registered domains with their team, Script tag or Agentic crawler mode, wildcard and suspension state, page by page.
• Register domainsPOST /v1/domains registers up to 100 domains in a team in one call and reports, per domain, whether it was created, already existed or was invalid.
• Delete domainsDELETE /v1/domains removes up to 100 domains from a team by domain ID and reports, per ID, whether it was deleted or not found.

Payment pages

• Add a payment pagePOST /v1/payment-pages adds one payment page selector to a team, the same selectors you manage in Setup step 4, and says whether it was new.

Events

• WebhooksReceive Script Monitoring alerts on your own URL. Verify the x-scriptmonitoring-signature HMAC-SHA256 header and read the alert.created JSON payload.