Your website may be compromised without going down

Your website may run scripts that your team does not maintain. Analytics, chat and other tools execute in the visitor's browser. A compromised script can affect that visitor while the site remains available. Uptime monitoring will not establish what those scripts are doing.

What a quiet compromise looks like

Magecart-style attacks have worked the same way for years. An attacker doesn't need to break into your site.

They compromise a library that one of your third-party scripts depends on (a chat widget dependency, an analytics SDK, a payment form module). They add a few lines of JavaScript that silently copies payment form data to an external server.

A payment can complete while the page appears to work normally. The only difference is someone else now has their card number and CVV.

The same principle applies to credential theft (modified scripts reading login forms), session hijacking, redirecting selected visitors to phishing pages, or even cryptojacking, where the visitor's browser mines cryptocurrency. The site is slower, but it "works."

In every one of these cases the website looks fine. You find out from a fraud report from your acquiring bank.

Or you don't find out at all.

What Cloudflare just opened up

Cloudflare makes basic Client-Side Security available on all plans. Malicious-script detection and related capabilities require the Client-Side Security Advanced add-on.

Assign an alert owner and define escalation rules. Then test the detection against the scripts your own site loads. Detection also needs regular review and a response process. Cloudflare Client-Side Security.

The basics that most sites still skip

Even without Cloudflare, two things should be in place on any site that handles logins or payments:

Content Security Policy (CSP), an HTTP header that tells the browser which domains can serve scripts. If a script loads from an unauthorized source, the browser blocks it.

The catch is that most sites have no CSP at all, and the sites that do have one often use unsafe-inline or unsafe-eval, which can weaken protection against injected code depending on the configuration. CSP isn't set-and-forget either. Every new widget modifies it. So does every analytics change and every payment integration.

Subresource Integrity (SRI), a hash attached to external script tags, so if the script content changes (say, after a CDN compromise), the browser refuses to run it. Simple, effective for static dependencies.

Open DevTools in your browser and count how many external domains your site contacts on the Network tab. That number is usually higher than anyone expects.

For the broader cybersecurity picture, we've written about how AI is changing phishing and deepfake attacks and about phishing campaigns currently targeting Slovak companies. On the infrastructure side, CI/CD pipeline security is a related concern.

If your site runs third-party scripts, it's worth knowing what they're doing. We can run a security check and set up CSP properly.