Tell HN: Cloudflare silently injects its analytics when you switch nameservers

Hacker News Discussion ↗

Cloudflare is being criticized for automatically injecting its JavaScript-based Web Analytics beacon into sites that use its reverse proxy/CDN, even when site owners believed they had disabled analytics or only wanted DNS services. Commenters argue this “man-in-the-middle” content modification erodes trust, raises privacy and GDPR questions, and exemplifies dark-pattern defaults that favor Cloudflare’s data collection over user consent. Others counter that TLS termination and inline modifications are inherent to Cloudflare’s core proxy offering, note that the feature can be turned off, and suggest that users who want guarantees against such changes should avoid proxy-based CDNs altogether.

What Cloudflare Changed

  • Cloudflare now injects a JavaScript beacon (cloudflareinsights.com) into proxied sites to power its Real User Measurement (RUM) “Web Analytics” and Observatory tools.
  • This is enabled by default on free plans; paid plans are opt‑in only.
  • Some users report Web Analytics showing as disabled, but having to enable it just to access the option to turn the beacon off.

When Injection Happens (Proxy vs DNS)

  • Injection only occurs when Cloudflare is acting as a reverse proxy (orange cloud / “Proxied” records), not when domains are DNS‑only (grey cloud).
  • With proxied records, TLS terminates at Cloudflare, so it can see and modify HTML responses in transit.
  • Several users were unaware they had enabled proxying, or found the UI/initial defaults confusing or biased toward proxy-on.

User Reactions & Trust Concerns

  • Many see script injection as a serious trust violation, especially for deliberately JS‑free or privacy‑focused sites.
  • Some call it a MITM behavior and compare it to old free hosts injecting ads; others argue this is inherent to using a CDN that terminates TLS.
  • There is worry about “enshittification”: today analytics, tomorrow ads or more intrusive modifications.

Privacy, Legal, and GDPR Discussion

  • Cloudflare’s blog and dashboard indicate EU/UK traffic is excluded by default for this feature; global enablement is optional.
  • Debate over GDPR compliance:
    • One side says they avoid storing IPs and EU data, so risk is reduced.
    • Others note site owners remain legally responsible for third‑party tracking they may not even know about.
  • Concern that existing privacy policies are inaccurate if they don’t mention this tracking.

Opt‑Outs, Mitigations, and Alternatives

  • RUM can be disabled per domain via Analytics → Web Analytics → RUM settings.
  • Setting DNS records to “DNS Only” stops Cloudflare from touching payloads but also disables CDN/WAF features.
  • Technical countermeasures like CSP or Cache-Control: no-transform are noted as ineffective if Cloudflare can rewrite responses.
  • Some recommend alternative DNS/CDN providers and caution against unnecessary use of Cloudflare, especially for small sites.

Defenses of Cloudflare’s Approach

  • Some argue RUM is a reasonable free feature, consistent with Cloudflare’s role as a proxy, and valuable for performance debugging.
  • Others emphasize that free users should expect data collection and that operators must stay informed about their infrastructure choices.