Cloudflare Page Shield pricing
Page Shield, now called Client-Side Security, is bundled into every Cloudflare plan, but the parts that satisfy 11.6.1 sit on a paid add-on at $0.099 per 1,000 requests. Here is what is included where.
TL;DR
Cloudflare Page Shield pricing
BUNDLED, THEN AN ADD-ON
Script monitoring is on every plan. The change-detection alerts 11.6.1 asks for are on Client-Side Security Advanced, a paid add-on.
WHAT THE ADD-ON COSTS
$0.099 per 1,000 requests, self-serve since March 2026. Cloudflare estimates it from your previous month's HTTP requests.
THE THING TO CHECK
"Included in your plan" and "enough for 6.4.3 and 11.6.1" are not the same statement.
Short on time? Both prices are now published, so you can do the arithmetic for your own traffic. See it.
How much does Cloudflare Page Shield cost?
There are two answers. Script monitoring is included on all Cloudflare plans, so if you only want a list of scripts the marginal cost is zero. The alerting and blocking that PCI DSS 11.6.1 asks for sit on Client-Side Security Advanced, formerly the Page Shield add-on, and it costs $0.099 per 1,000 requests. Cloudflare opened it to self-serve customers in March 2026, when Page Shield was renamed Client-Side Security, and estimates the cost from your previous month's HTTP requests before you commit. In Cloudflare’s own plan matrix, content security rules read zero on Free, Pro, Business and Enterprise, and five on Advanced.
One first-party tag, added the way your stack already ships code. No DNS change and no CDN change, because your traffic is never routed anywhere.
What you get on each plan
1
Free and Pro
Script monitoring only. No connection monitoring, no cookie monitoring, and no change-detection alerts.
2
Business
Adds connection and cookie monitoring, plus new resource and domain alerts. Still no code-change alerts.
3
Enterprise
The same client-side feature set as Business. Content security rules still read zero.
4
Client-Side Security Advanced
The paid add-on. Code change detection, malicious script detection and five content security rules. $0.099 per 1,000 requests, self-serve.
5
The PCI consequence
11.6.1 asks you to be alerted when a script or header changes. On Cloudflare that alert is an add-on above every base plan, Enterprise included.
What to check before you switch it on
Your estimated bill for the add-on, not the plan, because the plan on its own does not give you change-detection alerts
Which requests the estimate counts, and whether it applies per zone or per account, so you know what happens when traffic or domains grow
What proportion of responses are sampled, because Page Shield adds its header to a sample of HTML responses rather than all of them
Whether you can export evidence for an assessor, rather than pointing them at a dashboard
What happens to your client-side features if you move off your current plan tier
Whether five content security rules is enough for the payment pages you need to cover
Our pricing is published too, so you can compare the two directly.
Comparing against something published
Ours: free for 1,000 page views a month, $99/month for 100,000 payment-page views, $499/month at 500,000, $799/month at 1,000,000, overage at $0.0013 per page view, annual billing at 10 months instead of 12. Both PCI requirements are included on every plan, including the free one.
The comparison that matters is not plan against plan. It is what you pay in total to satisfy 6.4.3 and 11.6.1: a Cloudflare plan plus the Advanced add-on at $0.099 per 1,000 requests, against $99 a month with nothing added on top. Because the add-on is metered per request rather than per payment-page view, its bill scales with your traffic: one million requests a month is $99, ten million is $990.
Worth saying plainly: if you already run Cloudflare, script monitoring costs you nothing extra and is a reasonable place to start looking. The gaps are the alerting, the sampling and the evidence export. Full detail in the Cloudflare Page Shield comparison.
Sources and methodology
PCI DSS requirement text is quoted from PCI DSS v4.0.1 (June 2024), published by the PCI Security Standards Council, which is the current version at the time of writing. Requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025. Where we describe a competitor, we describe publicly available information and say so when something should be verified with the vendor. We publish this product and that is a bias worth knowing about while you read. Primary sources: Cloudflare plans and pricing, Cloudflare Client-Side Security docs and Cloudflare's March 2026 announcement.
ASK AN AI
Don’t just take our word for it
Ask your assistant what to look for in a tool for PCI DSS 6.4.3 and 11.6.1.
Frequently asked questions
Script monitoring is included on all plans, so seeing a list of scripts costs nothing extra. The change-detection alerts and blocking rules that PCI 11.6.1 needs are on Client-Side Security Advanced, a paid add-on at $0.099 per 1,000 requests.
No base plan is sufficient on its own. Code change detection alerts are listed as Advanced-tier only, and content security rules read zero on Free through Enterprise, so the add-on is required even on Enterprise.
$0.099 per 1,000 requests. Cloudflare renamed it Client-Side Security Advanced in March 2026 and made it self-serve, with the cost estimated from your previous month's HTTP requests.
Yes. Cloudflare documents that the Page Shield header is added to a sample of HTML responses, and they do not publish the rate. Low-traffic domains take longer to produce a first report as a result.
No. It works from sampled responses, which is why a payload that fires for a narrow slice of traffic can be missed. We inspect 100% of sessions with no sampling.
Only with content security rules, which are five on Advanced and zero on every base plan.
No. It requires your traffic to be on Cloudflare. Ours is one first-party tag and works with any CDN or none.
It is the current name for what was sold as the Page Shield add-on. The feature set is unchanged: code change detection, malicious script detection and a small number of blocking rules.
It gives you script visibility. What teams usually find missing is the change alerting without the add-on, full session coverage, and an evidence export rather than a dashboard view.
If you are already on Cloudflare, multiply your monthly requests by $0.099 per 1,000 and compare it against $99 a month all-in. Our free plan covers both requirements at 1,000 page views a month if you want to test the comparison first.
Related articles
Comparisons
Best client-side security tools in 2026
Thirteen tools, each with real pros and real cons, and an honest statement of our own bias.
Comparisons
Does Cloudflare make you PCI compliant?
What the WAF, the CDN and Page Shield each do for 6.4.3 and 11.6.1, and what they leave with you.
Comparisons
Best PCI compliance software in 2026
Full-scope platforms and client-side tools are different categories. Both lists, kept apart.
PCI DSS
PCI DSS compliance: a practical guide for 2026
What the standard covers, what changed in v4.0.1, and where the two client-side requirements fit.
See every script on your own checkout.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.