Page Shield

Acest conținut nu este încă disponibil în limba selectată.

Page Shield works on the responses your app sends. The connector adds the security headers your app leaves out and grades each host from A+ to F. It carries your Content Security Policy and lists what browsers report against it. It can put a consent banner on your pages that holds the trackers until the visitor accepts. On the Qlyne proxy and hosted, it also keeps whole pages and API responses in memory for the time you choose, with purge from the dashboard or from your deploy.

Turn it on

Connector	What works
Qlyne proxy	Everything on this page
Hosted by Qlyne	Everything on this page
Cloudflare Worker	Headers, grade, CSP with violation reports and the consent banner. No page cache and no purge.

Connect the site (Choose the integration).
Open the site and go to Page Shield › Configuration. Pick a protection level, then fine-tune under Advanced.
For the banner, go to Page Shield › Cookie consent. For the cache, Page Shield › Page cache.

Changes reach the connector within a minute. Page Shield does not wait for “Enforce” in Connector › Configuration: headers, CSP, banner and cache apply in observe mode too.

Protection levels

The level at the top of Page Shield › Configuration fills the header settings and the CSP mode, then saves. Change any of them by hand and the level shows as “Custom”.

Setting	Basic	Balanced	Aggressive
HSTS	Off	On, one year	On, including subdomains
`X-Content-Type-Options: nosniff`	on	on	on
Referrer-Policy	Off	`strict-origin-when-cross-origin`	`same-origin`
Framing	Off	Only my own site	Nobody
CSP mode	Off	Report only	Enforce

A level never touches your policy, Permissions-Policy, the banner or the page cache. Balanced and Aggressive turn the CSP on, so they need a policy in the “Policy” field first; without one, saving asks you to write it.

On Free, the CSP mode a level fills is saved and applies as soon as the account is on Pro.

Settings

Security headers

Under Page Shield › Configuration, Advanced, the “Security headers” card:

“HSTS”: “Off”, “On, one year” or “On, including subdomains”. Sent only over HTTPS.
“Framing”: “Only my own site” (X-Frame-Options: SAMEORIGIN) or “Nobody” (DENY). Keep it off if other sites embed your pages.
“Referrer-Policy”: one of four policies, or off.
“Permissions-Policy”: one line, like camera=(), microphone=().
“X-Content-Type-Options: nosniff”.

A header goes on a response only when your app does not send it already. When the app sends its own, the app’s value wins.

The same card shows the grade for up to three hosts, with what each is missing. It counts six protections on the HTML pages that went through the connector, your app’s own headers included:

HSTS with a max-age of at least 180 days;
a Content Security Policy;
X-Content-Type-Options: nosniff;
a Referrer-Policy other than unsafe-url or no-referrer-when-downgrade;
framing protection, by X-Frame-Options or frame-ancestors in the CSP;
a Permissions-Policy.

All six give A+, five A, four B, three C, two D, fewer F. The grade appears less than a minute after a page of your site goes through the connector, and it always shows the latest page seen on each host.

Content Security Policy (Pro)

A Content Security Policy tells the browser which scripts, images and connections a page may use. The “Content Security Policy” card takes:

“Mode”: “Off”, “Report only” or “Enforce”;
“Policy”: one line up to 4,000 characters, directives separated by semicolons, like default-src 'self'; script-src 'self' https://www.googletagmanager.com.

In “Report only”, the connector sends the policy as Content-Security-Policy-Report-Only: the browser loads everything and reports what the policy would have blocked. In “Enforce” it goes as Content-Security-Policy and the browser blocks.

The connector takes out any report-uri or report-to in your policy and adds its own. Browsers then post each violation to the page itself, at ?__qlyne=csp, and the connector answers with an empty 204. On the Qlyne proxy and hosted it also sends Reporting-Endpoints; the Worker uses report-uri only.

Below the policy, “Blocked in the last 7 days” lists the ten most frequent violations: what was blocked, the directive and how many times.

The connector does not generate nonces. To allow an inline script, add its hash ('sha256-…') to your policy, or move the script to a file on your domain.

Under Page Shield › Cookie consent.

“Inject on the edge” (Pro): with “Turn on edge injection” on (it saves as you flip it), the connector adds the banner to the <head> of each HTML page. It also holds the known trackers until the visitor accepts their category:

Analytics: Google Analytics, Google Tag Manager, Hotjar, Segment, Microsoft Clarity, FullStory, Mixpanel, Mouseflow, Crazy Egg.
Marketing: the Meta (Facebook) pixel, DoubleClick, Google Ads, TikTok, LinkedIn.

On the Qlyne proxy and hosted, scripts, image pixels and iframes from those addresses are held. On the Worker, only <script src> tags are, and the list leaves out the Meta image pixel and Google Ads conversion tracking.

“Banner” sets what the visitor sees. “Simple” has the accent color and the categories; “Complete” adds the rest:

“Accent color”;
“Categories the visitor can choose”: “Analytics”, “Marketing”, “Functional”;
“Position on screen”: “Bottom bar”, “Top bar”, “Bottom left”, “Bottom right” or “Center modal”;
“Language”: “Visitor’s language”, English or Português;
“Privacy policy URL”: a path like /privacy or a full https:// address;
“Custom message”: up to 300 characters, or empty for the default text.

Press Save after changing the banner.

“Or paste it yourself” (any plan): copy the <script> tag into the <head> of your site. Nothing is held for you, so mark each tracker by changing its tag to type="text/plain" with data-qlyne-consent and the category. The screen shows the example with Google Analytics. Use the same marking for your own scripts with injection on.

Page cache (Pro)

Under Page Shield › Page cache, on the Qlyne proxy and hosted.

“Cached routes”: a path pattern (* matches anything, like /blog/*) and how long it stays, from 1 to 86,400 seconds (24 hours). Up to 50 routes.
“Login cookies”: the names of the cookies that mean a visitor is logged in, one per line, up to 20. A cookie whose name contains one of them stops the cache; others, like analytics cookies, do not. Empty means any cookie stops the cache.

A response is cached only when all of this holds:

the request is a GET, with no Authorization header and no login cookie;
the response is a 200 in HTML or JSON, up to 2 MB;
it has no Set-Cookie, no Cache-Control: private and no Vary beyond Accept-Encoding.

The time you set for the route wins over no-cache or no-store from your origin. If your origin sends stale-while-revalidate, an expired page is served while the connector fetches a fresh one in the background. If the origin fails, an expired copy keeps being served for up to an hour. When many visitors ask for the same page at once, the origin gets one request.

The consent banner and the bot score script are added on each request, so a page from the cache still carries them.

On the Qlyne proxy, the memory for the cache is QLYNE_CACHE_MB (64 MB by default; see Settings).

Purge (Pro)

After you publish a change, clear the copies you changed.

From the dashboard, under Page Shield › Page cache, “Purge”: “Purge everything”, or type a path and press “Purge this path”. A path works as a prefix: /blog/post also clears /blog/post?utm_source=… and /blog/post-2, and / clears everything.

From your server or your deploy script, call the connector on your own domain with the connector secret:

curl -X POST https://example.com/__qlyne/purge \
  -H "Authorization: Bearer your_connector_secret" \
  -H "Content-Type: application/json" \
  -d '{"paths": ["/blog/new-post"]}'

The body takes {"all": true}, {"paths": [...]} (by prefix) or {"tags": [...]}. Tags and paths combine in one call. The answer is 200 with {"purged": 12}, the number of copies cleared. Without the right secret the address answers 404. Keep this call on the server: the secret must never reach a browser.

To purge by tag, have your origin send X-Qlyne-Cache-Tags: product-123, home on the responses. The connector keeps the tags and removes the header before the visitor gets the page. Saving product 123 then purges {"tags": ["product-123"]}, and every cached page that showed it goes at once.

What visitors see

Security headers: nothing on the page. The browser applies them. With HSTS on, after one visit over HTTPS the browser uses HTTPS only for a year.
CSP: in “Report only”, nothing changes. In “Enforce”, what the policy does not allow stays out of the page, like a script or an image from another address.
Consent banner: a bar, a corner box or a centered window, in English or Portuguese by the browser language. The default text is “We use cookies to improve your experience. You choose what to allow.”, with “Accept all”, “Reject” and “Preferences”. “Preferences” lists “Necessary (always on)” and the categories you offer. The choice stays in the visitor’s browser, in the qlyne_consent cookie, for 180 days; nothing about it reaches Qlyne. A button on the page opens it again.
Page cache: the same page, from the connector’s memory. The response carries x-qlyne-cache: HIT with Age, STALE for an expired copy, or MISS when it came from your origin. A logged-in visitor always gets the page from your origin, without the header.

Limits

The page cache and purge are on the Qlyne proxy and hosted only. On Cloudflare, use Cloudflare’s own cache rules.
Each Qlyne proxy keeps its own cache. With several proxies, a purge clears only the one that received it, so send it to each.
Purge by tag is through the API only; the dashboard purges everything or one path.
The Worker reports CSP violations through report-uri only, without report-to or Reporting-Endpoints.
A CSP in “Enforce” can break scripts your policy forgets. Start in “Report only” and enforce when the list only shows what you expect.
The banner holds trackers loaded from the addresses above. Code written inline in the page runs anyway; mark your own scripts.
The banner shows to every visitor, wherever they are. Qlyne keeps no record of who accepted what.
The grade keeps only the latest page per host, with no history, and shows only under Page Shield › Configuration.

FAQ

Will it break my site?

Headers go only where your app sends none, and the CSP starts in “Report only”, where nothing is blocked. Three settings change what browsers do, so check them first:

HSTS makes browsers refuse plain HTTP to your site for a year. “On, including subdomains” covers every subdomain, so turn it on only when all of them serve HTTPS.
“Nobody” under “Framing” stops any site from showing your pages in a frame, yours included. “Only my own site” allows your own.
A CSP in “Enforce” blocks what the policy does not list. Read “Blocked in the last 7 days” for a few days in “Report only” first.

The page cache only touches the routes you add.

In the EU, analytics cookies usually need consent, since they are not necessary for the site to work. Under LGPD, consent is one of the legal grounds. If analytics is all you have, offer only “Analytics” in the banner. The banner is a tool and does not certify compliance; check with whoever handles your privacy policy.

How do I purge after publishing?

Add the purge call to your deploy, after the new version is live: {"all": true} for a full release, {"paths": [...]} for the pages you changed. For a store or a blog, tag the responses and purge the tag of what you saved. By hand, use “Purge everything” or “Purge this path” under Page Shield › Page cache.

What about logged-in pages?

A request with an Authorization header or a login cookie always goes to your origin, and nothing is cached from it. Fill “Login cookies” with every cookie that changes the page, a cart or a session included, not only the login one. With the list empty, any cookie skips the cache, so visitors with an analytics cookie skip it too. Your origin can also keep a response out by sending Set-Cookie or Cache-Control: private.

Does it work on Free?

Part of it. On Free: the security headers and the grade, and the banner by pasting the snippet. Pro adds the CSP with its violation list, the banner injected at the edge and the page cache with purge. Every new account starts with 7 days of Pro, no card. See Plans.

Troubleshooting

The CSP blocked a script

Open “Blocked in the last 7 days”: each line shows the blocked address and the directive. Add that address to the directive in your policy, like script-src 'self' https://www.googletagmanager.com. For an inline script, add its hash or move it to a file. With the injected banner, the policy must allow https://app.qlyne.com in script-src. Switch to “Report only” while you fix it; the change reaches the connector within a minute.

Check, in this order:

the site is on Pro and “Turn on edge injection” is on. On Free the switch is off; paste the snippet;
the site goes through the Qlyne proxy, hosted or the Worker. The Next.js middleware does not inject it, so paste the snippet there;
you have not answered it already: the choice stays 180 days. Open the site in a private window;
a CSP in “Enforce” is not blocking https://app.qlyne.com.

A page does not go into the cache

Request it twice and look at x-qlyne-cache in the response.

No header: the request did not qualify. The path is not in “Cached routes”, the site is not on Pro, the request is not a GET, or it carries Authorization or a cookie that stops the cache. With “Login cookies” empty, any cookie stops it, your analytics cookie included.
MISS every time: the response is not storable. Look for a Set-Cookie your framework sends on every page, Cache-Control: private, a status other than 200, a type other than HTML or JSON, a Vary beyond Accept-Encoding, or a page over 2 MB.
On the Cloudflare Worker there is no page cache.