Documentation
ProxiedGuardians sits in the request path between your visitors and your web server. Pages pass through our edge on the way out, where security headers, per-request nonces and integrity attributes are applied to the HTML as it streams. Nothing is installed on your server, and no application code changes.
What it does
Three protections, all applied at the edge:
| Protection | What it stops |
|---|---|
| Content Security Policy | Injected and unauthorised scripts — the engine behind most XSS. A fresh nonce per request means a policy scraped from one page is worthless on the next. |
| Script integrity | A third-party script whose contents changed without you knowing. We inventory every script your pages load and hash it, so a modified file raises an alert — or gets blocked outright. |
| Magecart detection | Card skimmers. A runtime sentinel watches outbound requests from the page and reports data leaving for a host you never approved. |
How it fits together
You point one DNS record at us. We terminate TLS with a certificate issued and renewed automatically, fetch your real content from your server, and apply your policy to the HTML on the way back. Your server's own certificate is untouched, and your application never sees a change.
Start here
Getting started →
Add a domain, point one DNS record, go live.
Content Security Policy →
Start in Report-Only, read the violations, then enforce.
Script integrity →
Monitoring by default; blocking when you turn on Safe Mode.
Magecart detection →
What the sentinel watches and how to read its alerts.
Root domains →
Why a bare domain needs a redirect, and how to set one up.
FAQ →
Certificates, email, downtime and the questions that come up most.