Frequently asked questions
The questions that come up most, answered plainly — including the ones where the honest answer is a caveat.
Setup and DNS
Will my site go down when I switch DNS?
There is a short window between your DNS pointing at us and the certificate being issued, during which a visitor can get a TLS error. It is usually a few minutes. On a live site, make the change at a quiet hour, and lower that record's TTL to 300 a day beforehand so a rollback takes minutes rather than hours.
How long does the certificate take?
Normally a few minutes once DNS resolves to us. If it stays pending much longer, the usual cause is a DNS record that has not propagated yet — the certificate authority has to see it before it will issue. The Edge tab keeps retrying on its own; you do not need to do anything.
Does this affect my email?
No. Mail delivery uses MX records, which point at your mail
provider and are completely separate from the record that serves your
website. Your SPF, DKIM and DMARC
records are untouched as well.
Do I need to install anything on my server?
No. There is no agent, no package and no daemon. We never need access to your server, and your web server configuration does not change.
What about my server's TLS certificate?
It stays exactly as it is, and keeps renewing as it does today. We terminate TLS for visitors with our own certificate and connect to your server separately.
Does one entry cover my whole domain?
No — each hostname is configured separately. Protecting
www.example.com does not cover shop.example.com;
that needs its own entry and its own DNS record. Bare root domains are a
special case covered in Root domains.
Running it
How quickly do my changes take effect?
Within about a minute. Policy changes are pushed to every edge location straight away; each location holds the configuration briefly to keep lookups off the critical path, so allow up to a minute rather than expecting the change on the very next reload.
Something on my site stopped working. What do I check?
In order:
- Open the browser console. It names the directive that refused and the resource — that is usually the whole answer.
- If it is a script that used to load, check the SRI Approvals tab. With Safe Mode on, a file whose contents changed is held until you approve it.
- If you just enforced a policy, switch it back to Report-Only. The site recovers immediately and the violations tell you what to allow.
Do you cache my pages?
We do not add caching of our own. Pages are fetched from your server and rewritten as they stream, so your own cache headers continue to govern behaviour. Because every response carries a fresh nonce, HTML must not be cached as a shared copy — if you cache HTML at another layer, exclude it or vary on the policy header.
What happens if your edge has a problem?
It fails open. If anything goes wrong while rewriting a page, we serve your original content unmodified — the visitor loses the injected policy for that request, not your website.
Does this slow my site down?
The rewriting is streaming: your HTML is modified as it passes through, so the browser starts receiving bytes before your server has finished sending them. There is no point where a whole page is buffered.
Compliance
Does this satisfy PCI DSS 6.4.3 and 11.6.1?
Those requirements ask you to keep an inventory of the scripts on your payment pages, justify and authorise each one, and detect unauthorised changes to scripts and security headers. The script inventory builds itself from what actually loads in real browsers, and content changes raise an alert — see Script integrity. What a tool cannot do for you is the justification and authorisation record; that remains your documentation, and your assessor's call.
Where is violation data stored, and for how long?
CSP violation reports and Magecart alerts are stored in our analytics infrastructure and are visible under each domain's Violations and Magecart tabs. Page content itself is processed in memory and never persisted. The Privacy Policy covers this in full.
Leaving
How do I remove a domain?
Point your DNS back at your own server first, then use Remove from ProxiedGuardians on the domain's Edge tab. The order matters: the record still sends visitors to us, and once the domain is removed we no longer recognise the hostname — those visitors would get a TLS error instead of your site.
What happens to my site if I stop paying?
Nothing breaks without warning. Your site keeps being served while the account winds down, giving you time to point DNS back at your own server. We will never leave a customer's site unreachable over billing.