Does Cloudflare Make You PCI Compliant?
Cloudflare is a PCI DSS compliant service provider, and TLS and the WAF map onto requirements 4 and 6.4.1. But compliance is assessed against your environment, and PCI DSS 6.4.3 & 11.6.1 need a control that sees what scripts do inside the browser, where a CDN or WAF can't look. This video covers what Cloudflare's CDN, WAF and Page Shield (now Client-Side Security) each do for the two client-side requirements, and the three things to check if you're on Cloudflare. Disclosure: we make Script Monitoring, which competes with Page Shield. Cloudflare's own scripts under /cdn-cgi/ (email obfuscation, bot challenges, Zaraz, Rocket Loader) are not out of scope either: they run on your payment page like any other script, so list and justify them for 6.4.3, or switch off the features you don't need on payment pages.
Full answer: Does Cloudflare Make You PCI DSS 4.0.1 Compliant?
Transcript
No. Cloudflare covers real parts of PCI DSS, but compliance is assessed against your own environment, not your CDN vendor's. We make Script Monitoring, which competes with Cloudflare's Page Shield, so we're biased. For 6.4.3 & 11.6.1, the control has to see what executes inside the browser. A CDN sits in front of that, not inside it. First, what Cloudflare genuinely covers. TLS, for requirement four. The WAF, the usual way to meet 6.4.1. And their own Attestation of Compliance, which your assessor will want on file. But Cloudflare's compliance covers Cloudflare's systems, not yours. The page your origin serves, the scripts it loads, and your customer's browser session are still yours. A WAF inspects traffic in transit. It can't see a script read a card field, send it to an attacker, or a trusted vendor ship altered code at the same address. So the WAF doesn't satisfy 6.4.3. A CDN can watch your own HTML and headers change. That's real 11.6.1 value, and the easy half: most of what goes wrong on a payment page never appears in your HTML. Page Shield, now called Client-Side Security, is Cloudflare's answer here, and it's a real product. If you're on Cloudflare, check it first: that it's switched on, what your plan includes, and what the evidence looks like. The base tier is on every Cloudflare plan. Code change detection, which 11.6.1 leans on, is on Advanced, a self-serve add-on priced per request. So check what your zone has today. Choose Page Shield if you're on Cloudflare, Advanced covers your assessor, and it's cheaper for your traffic. Choose us if you're not on Cloudflare, or want every session and the evidence as the product. Script Monitoring's evidence is a weekly PDF pack for your assessor, kept eighteen months, and it runs alongside Cloudflare with no DNS change. Script Monitoring is free for 1,000 page views a month, with both requirements on every plan. Pro starts at $99 a month. Start for free at scriptmonitoring.com.