Tell HN: Cloudflare silently injects its analytics when you switch nameservers

Posted by stagas 2 hours ago

A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.

114 points | 31 comments

dchest 1 hour ago|

Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

altairprime 5 minutes ago|

[delayed]

Animats 25 minutes ago||

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc

Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?

Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

bawolff 13 minutes ago||

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing.

It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

stagas 11 minutes ago||

I can’t recall if there was a setting to enable reverse proxy, if there was it was On by default since I didn’t expect to have reverse proxy enabled as well. But you can also rp without injecting a script. That’s overdoing it.

Insimwytim 16 minutes ago|||

> in order to enable R2 bucket serving through my own subdomain

I suspect it happens somewhere here

Touchnow 2 minutes ago||

[dead]

purpleidea 1 hour ago||

Yikes! I see this too:

kevincox 11 minutes ago|

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

celsoazevedo 1 hour ago||

Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

stagas 27 minutes ago|

No, I hadn’t enabled for any site. I had to enable first to turn it off.

outlines 28 minutes ago||

Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.

I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

stagas 26 minutes ago|

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

TiredOfLife 3 minutes ago||

> that also should have been opt-in.

The proxy is like 99% of why people use Cloudflare

ValentineC 1 hour ago||

Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.

monitorion 13 minutes ago||

We use Cloudflare tunnels for connecting distributed workers to central infrastructure. Haven't seen this on tunnel traffic, but good to know it happens on nameserver-managed sites. Another reason to audit what your CDN injects — same applies to checking your security headers regularly.

windexh8er 1 hour ago||

Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.

JoshTriplett 1 hour ago|

They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.

sscaryterry 57 minutes ago||

100% But this does not give you any useful personal data :)

JoshTriplett 56 minutes ago||

Or data for the increasingly invasive Cloudflare captcha.

BorisMelnik 1 hour ago||

yep, last website I did was JS free 100% except that pesky cloudflare script

minraws 59 minutes ago|

Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.

busymom0 16 minutes ago|

Yes there is. I have it disabled on mine:

https://limereader.com/

More comments...