Tell HN: Cloudflare silently injects its analytics when you switch nameservers
A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.
Discussion Highlights (20 comments)
csomar
To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.
windexh8er
Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.
celsoazevedo
Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?
purpleidea
Yikes! I see this too: <script type="module" src=" https://static.cloudflareinsights.com/beacon.min.js/v4513226... " integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
moktonar
Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?
ValentineC
Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.
dchest
Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...
pudgywalsh
You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required. If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
BorisMelnik
yep, last website I did was JS free 100% except that pesky cloudflare script
minraws
Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.
yogorenapan
Noticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off
outlines
Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled. I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
Animats
> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
monitorion
We use Cloudflare tunnels for connecting distributed workers to central infrastructure. Haven't seen this on tunnel traffic, but good to know it happens on nameserver-managed sites. Another reason to audit what your CDN injects — same applies to checking your security headers regularly.
okzgn
An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
Symbiote
It's not necessary to use Cloudflare hosted DNS to use R2 with a custom subdomain. Make a CNAME record the same way you would for a CDN subdomain. (I am not yet running this in production, YMMV.)
jjcm
Thank you for this. I indeed had it up on mine. Cloudflare has switched defaults a couple times now, which honestly is wild to me.
p0w3n3d
Spies. Spies everywhere
kazinator
If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML? You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.
sparsesignal
I noticed the same thing with email-decode.min.js on my site. It turns out it's the "Email Address Obfuscation" feature, which I didn't expect to be on by default.