Cloudflare Silently Injects Its Analytics When You Move Your NS Servers

A Hacker News poster going by stagas moved the name servers of his site textlog.cc over to Cloudflare — he needed to serve the contents of an R2 bucket through his own subdomain. The site was pointedly minimalist: clean HTML without a single line of JavaScript. Soon, however, it turned out that an analytics script from static.cloudflareinsights.com had quietly been added to his pages.

What outraged the author most was the approach itself. To get rid of the imposed code, he first had to open the analytics panel, add the site there — and only then disable data collection. In his view, features like this should work on an opt-in basis (explicit consent) rather than opt-out, where the user has to go out of their way to switch them off.

The discussion quickly surfaced the technical background. Simply hosting DNS with Cloudflare doesn't change your pages — several participants confirmed that with their domains in “DNS only” mode there were no injections at all. The script shows up when Cloudflare's reverse proxy is enabled (the “orange” cloud icon rather than the “gray” one). The author admitted that he had probably missed the relevant option: the proxy turned out to be on by default. That said, as the commenters noted, proxying is precisely the main reason most people turn to Cloudflare in the first place.

A separate, sensible argument was raised: since Cloudflare already routes all traffic through itself as a reverse proxy, the company can collect telemetry about requests without touching the page contents at all. Injecting third-party JavaScript, in that sense, looks superfluous — and it's a reminder that whoever sits in the middle can, if they wish, not only count statistics but also read unencrypted traffic.

Readers suggested practical measures. You can disable the injection by switching the DNS records to “DNS Only” mode (the gray cloud) under DNS → Records. As a client-side defense, they mentioned the Content-Security-Policy header with a script-src directive that limits script loading to trusted sources. And to serve R2 through your own subdomain, the discussion added, there's no need to hand Cloudflare your name servers at all — a CNAME record is enough, just as with any CDN.

The overall tone of the discussion was rather gloomy: it isn't the first time Cloudflare has changed default settings, and many saw in it the familiar script of a service gradually getting worse. The good news is that the analytics can be turned off after all — if you know where to look.

Source: Hacker News