Thank you for choosing the Source Defense security platform to enhance your website’s protection and meet PCI 6.4.3 and 11.6.1 requirements. This document provides instructions to help you deploy the Source Defense solution efficiently and securely. By following these steps, you will ensure that your web pages are equipped with the necessary safeguards to prevent potential threats and maintain compliance with modern security standards.
The deployment process involves simple but crucial steps, including the installation of an HTML <script> tag and updating your Content Security Policy (CSP) settings, where applicable. Each section of this guide provides detailed directions, best practices, and examples to make the implementation process as seamless as possible.
We recommend carefully reviewing the instructions and adhering to the provided guidelines to guarantee optimal performance and security. If you have any questions or encounter challenges during the setup, our support team is available to assist you at every step of the way. Contact Support
Let’s get started.
General
The deployment of the Source Defense security platform consists of several simple steps per domain –
- Install the provided HTML <script> tag at the top of the <HEAD> element of desired pages (for Protect – Limited, this is only required on pages containing payment buttons and/or fields).
- When applicable – update your CSP whitelist to include Source Defense.
Step 1 – Install the HTML <script> tag
The Source Defense platform HTML <script> tag will be placed once in the top of the <HEAD> element of the page.
When placing the tag, make sure to follow the below guidelines –
- The tag must be implemented as is, and any change could affect the security of the website
- All requests must be HTTP; by design, Source Defense will not execute on websites using plain-text HTTP connections due to security considerations
- The tag must be placed at the top of the <HEAD> element above any other JavaScript
- The tag must load synchronously, Do not add the ‘defer’ property or any other properties to the tag
Tag structure and variables
Below is an example of the main Source Defense HTML <script> tags. The parameters in purple should be replaced with the actual values for your account. The values for your account have been provided in a separate email.
Example of Source Defense tag for a Full SaaS deployment:
<script>
vice = {
config: {
viceAccountId: “accountId”,
viceSiteId: “siteId”,
viceSectionId: “sectionId”
}
}
</script>
<script src=”//vice-prod.sdiapi.com/vice_loader/accountId/siteid”></script>
Tag variables:
AccountId: The ID of your account in the platform as provided to you by Source Defense support. The AccountId can only contain letters and numbers with no spaces.
SiteId: The ID of your site in the platform as provided to you by Source Defense support. The SiteId can only contain letters and numbers with no spaces.
Step 2 – Update CSP
In case your web properties are using content security policy (CSP). You will need to whitelist the Source Defense domains in your policies to make sure the platform is not blocked by them.
Please add *.sdiapi.com and *.sdiapi.net to the following CSP directives:
- script-src
- connect-src
- frame-src
- worker-src
- frame-ancestors