Client Side Protection | Check Point WAF

Overview

As part of PCI DSS 4.0 requirements for Client-Side Protection (Requirements 6.4.3 and 11.6.1), CloudGuard WAF introduces automatic Script and IFrame Discovery and Authorization. These features help organizations:

• Identify all external JavaScript and iframe resources loaded by their web applications
• Detect and prevent unauthorized or unexpected third-party scripts
• Enforce a “trust-list” model for external sources
• Reduce the risk of client-side attacks such as Magecart, form-jacking, or malicious injections
• Maintain PCI DSS visibility and control requirements

How to set up Client Side Protection?

Step 1: Add URIs to Start Discovery

• Navigate to Client-Side Protection Practice → Content & Headers Discovery.
• Add one or more URIs representing pages you want the system to analyze.
• Discovery will not start without at least one URI.

To Avoid Learning Inline Scripts check the following checkbox:

Step 2: Configure Security Header Checks

Set Security header check to one of the following:

• Inactive
• Validate server security headers
• Validate full security-header policy

Step 3: Allow the System to Learn

• As traffic flows through the protected application, CloudGuard automatically identifies:
  • External JavaScript files
  • Inline scripts
  • Embedded iframes
• A banner at the top of the screen will notify you that Learning has started.

To receive email notifications for Client Side Protection events configure a notification trigger and connect it to the relevant asset.

• Discovery results appear in two places:
  • Client-Side → Discovered Scripts / Discovered IFrames
  • Learn tab, where the system summarizes findings during the learning phase

Step 4: Review Discovered Items

• Review each discovered script/iframe and determine whether it is:
  • Expected and safe
  • Unexpected, unknown, or suspicious

Step 5: Authorize Trusted Scripts & IFrames

• Approve legitimate resources directly from the Discovered list

To allow all inline scripts check the following checkbox

• Use Custom section to:

  • Add Scripts/Iframes that were not discovered yet.
  • Pre-authorize updated versions to deploy changes without needing re-discovery.
  • Define stricter allow-list rules.

• Adjust Script Authorization mode and Iframe Authorization mode

Step 6: Enable Enforcement

When ready: Enforce Policy

CloudGuard WAF will then block unauthorized or unexpected scripts and iframes.