","url":"https://news.ycombinator.com/item?id=49322782","author":{"@type":"Person","name":"purpleidea","url":"https://news.ycombinator.com/user?id=purpleidea"}},{"@type":"Comment","text":"Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...","url":"https://news.ycombinator.com/item?id=49322910","author":{"@type":"Person","name":"dchest","url":"https://news.ycombinator.com/user?id=dchest"}},{"@type":"Comment","text":"Thank you so much for info about this. Does anyone has list of known \"traps\" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.","url":"https://news.ycombinator.com/item?id=49327114","author":{"@type":"Person","name":"the4anoni","url":"https://news.ycombinator.com/user?id=the4anoni"}},{"@type":"Comment","text":"If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?\nYou must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.","url":"https://news.ycombinator.com/item?id=49323755","author":{"@type":"Person","name":"kazinator","url":"https://news.ycombinator.com/user?id=kazinator"}},{"@type":"Comment","text":"This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either or , can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).","url":"https://news.ycombinator.com/item?id=49323848","author":{"@type":"Person","name":"userbinator","url":"https://news.ycombinator.com/user?id=userbinator"}},{"@type":"Comment","text":"Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.\nI have all my domains set to DNS only, so no CF proxy. Wondering if that is why?","url":"https://news.ycombinator.com/item?id=49323216","author":{"@type":"Person","name":"outlines","url":"https://news.ycombinator.com/user?id=outlines"}}],"author":{"@type":"Person","name":"stagas","url":"https://news.ycombinator.com/user?id=stagas"},"publisher":{"@type":"Organization","name":"Zeli","url":"https://zeli.app","logo":{"@type":"ImageObject","url":"https://zeli.app/favicon.png"}},"isBasedOn":"https://news.ycombinator.com/item?id=49322107"},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Zeli","item":"https://zeli.app/"},{"@type":"ListItem","position":2,"name":"Cloudflare silently injects analytics into your site when you switch nameservers","item":"https://zeli.app/story/49322107"}]}]

Cloudflare silently injects analytics into your site when you switch nameservers

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

▲ 621stagas193 HN discussion
Cloudflare silently injects analytics into your site when you switch nameservers

A Hacker News user reports that after switching their nameservers to Cloudflare to enable R2 bucket serving, Cloudflare silently injected a JavaScript analytics snippet into their HTML-only, JS-free site. The user had to navigate to the Analytics dashboard, add the site, and then disable the snippet, calling the approach invasive and arguing that such features should be opt-in, not opt-out.

I find this approach entirely invasive, you should opt-in to features like that not have to opt-out.
Read original →RSS

HN discussion

193
  1. leinwand

    You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year.

    We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.

    This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.

    Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

  2. okzgn

    An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com">

    This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

  3. purpleidea

    Yikes! I see this too:

    <script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>

  4. dchest

    Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

  5. the4anoni

    Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.

  6. kazinator

    If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?

    You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.

  7. userbinator

    This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either </body> or </html>, can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).

  8. outlines

    Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.

    I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

More from this day

2026-08-16