alt.hn

8/16/2026 at 5:49:46 PM

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

by stagas

8/17/2026 at 3:04:13 AM

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year.

We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.

This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.

Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

by leinwand

8/17/2026 at 5:38:01 AM

Wow, this is ridiculous. Sites that have been running on Cloudflare for a decade+ silently got the treatment. Why the hell was there never a big banner telling me about this? I frequently log into the console.

I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, among other things. If I haven't given a damn about "powerful, in-depth monitoring solution that helps you debug and optimize applications" in over a decade, I certainly won't suddenly be "excited" about it when you sneakily inject it.

by oefrha

8/17/2026 at 10:46:43 AM

You get something for free, they announce it and you complain about not having a bigger announcement?

If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.

by mlrtime

8/17/2026 at 11:00:11 AM

> they announce it

Forgive me for not subscribing to their blog? That's not how you announce changes to customers.

Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.

by oefrha

8/17/2026 at 12:07:17 PM

Protest RIGHT NOW, not by complaining here but by getting rid of Cloudflare

This is unacceptable

by bunbun69

8/17/2026 at 12:50:07 PM

or... hear me out, do BOTH

by polymer8563

8/17/2026 at 6:20:27 PM

Maybe you're right. The important thing is to remember this moment the next time you're signing up for a free product that seems just a little too good to be true.

by troyvit

8/17/2026 at 11:56:32 AM

If you're running infrastructure you care about, you really need to own the responsibility of keeping up to date with what you're supporting. Free or not.

by _joel

8/17/2026 at 1:15:02 PM

It was on hacker news, back when they blogged it.

Nobody cared: https://news.ycombinator.com/item?id=45291323

by ChoGGi

8/19/2026 at 1:46:49 PM

> The RUM Diaries: Enabling Web Analytics by Default

With that title not many people clicked on it. I'm not surprised.

by tdeck

8/17/2026 at 11:52:31 AM

I bet those decade+ sites have been silently upgraded to TLS 1.3 too! Where are the complaints for that?

by taspeotis

8/17/2026 at 9:02:28 PM

On other forums than HN, but they surely do exist; check xda-developers, perhaps, for complaints from ancient Android users, as a theoretical sample of how to find them. Regardless, that’s one of the three certain customer outcomes when providing off-the-shelf services to human beings — free or not: it’s too expensive (in money and/or effort!), it doesn’t precisely fit their needs, and change is bad.

by altairprime

8/17/2026 at 10:21:42 AM

You can contract your comment to "I'm the product" and nothing would actually change.

by justsomehnguy

8/17/2026 at 3:50:36 AM

If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?

by tredre3

8/17/2026 at 9:02:13 AM

Just guessing.

* Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me

* Paid customers are usually business that have different needs, on average, than free customers

by socalgal2

8/17/2026 at 12:21:31 PM

> Seems reasonable to me

Only if they make it clear what they’re taking in return.

It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.

by jnovek

8/17/2026 at 4:38:06 AM

I have broadly good feelings about Cloudflare but this warrants a response.

by tacitusarc

8/17/2026 at 6:12:27 AM

Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.

by anon7000

8/17/2026 at 7:03:40 AM

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard.

If someone is mad, maybe they should pay or use a different architecture.

by cryptonym

8/17/2026 at 12:31:34 PM

I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.

by jnovek

8/17/2026 at 8:04:12 AM

> this is fair, they let you opt out, they give you a dashboard

So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

by whilenot-dev

8/17/2026 at 8:20:42 AM

You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling...

Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service.

Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

by cryptonym

8/17/2026 at 8:52:33 AM

> Makes me wonder if their stuff is GDPR-compliant without consent.

GDPR service providers and partners do not have to consent. Consent is for the users.

Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code.

*So you're liable if you host on cloudflare.*

Now, they somehow avoid this :

>when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want).

By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority

by hinata08

8/17/2026 at 8:38:15 AM

Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not.

There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.

by whilenot-dev

8/17/2026 at 9:03:47 AM

They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn.

GDPR is about legality and covers the LinkedIn case you mention.

by cryptonym

8/17/2026 at 9:19:48 AM

> They are not collecting and using your personal data.

Do you see how GDPR doesn't apply, then? ...you're contradicting yourself.

I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.

by whilenot-dev

8/17/2026 at 9:31:58 AM

GDPR very much applies.

As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.

Sibling comment says data collection is disabled in EU.

by cryptonym

8/17/2026 at 11:16:41 AM

Cool, so you went from

> Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture.

To "they would violate GDPR".

Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?

by whilenot-dev

8/17/2026 at 12:11:43 PM

I never said "they would violate GDPR". I was questioning if it could be the case. Someone said it's not the case as the feature is turned off in EU. Reading their blog, it also looks like they don't collect much identifiable data.

When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.

by cryptonym

8/17/2026 at 5:02:41 PM

If it's turned off for EU customers, it's a pretty clear case that it would be in violation of GDPR, wouldn't it?

by whilenot-dev

8/18/2026 at 9:35:20 AM

IANAL but it looks like they saw a risk and decided to not put you, as a website owner using their free tier, at risk of breaching GDPR for RUM. That was my concern and it's addressed.

by cryptonym

8/17/2026 at 7:33:12 AM

Shill

by Kevcmk

8/17/2026 at 8:15:26 AM

I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way.

When it's free you know you are being used, collecting data is the game.

by cryptonym

8/17/2026 at 5:10:50 AM

Because if something is free, you are the product.

by hecturchi

8/17/2026 at 6:14:09 AM

Not sure what is more appalling. Silently injecting javascript tracking, or writing a marketing-speech response like this without any substance at all

by schubidubiduba

8/17/2026 at 10:04:44 AM

While bad, this is far from the first problematic cloudflare behavior. They host a lot of sites with illegal content and refuse to action abuse reports. I support legal free speech, but any business who knowingly serves blatant pirate websites really shouldn't be trusted to behave ethically.

by Scaled

8/17/2026 at 5:48:32 AM

> It is on by default for free sites fr the reasons we wrote about in the blog post below.

Nowhere in the blog post does it give the reasons why it's A. on by default for free sites B. off by default for paid sites.

by deaux

8/17/2026 at 6:00:30 AM

What an amazing display of double speak. The only thing I didn't get is how is the DOW doing?

Btw I remember another time you tried to manipulate the DOM of peoples websites. It lead to Cloudbleed.

by Puts

8/17/2026 at 3:48:33 AM

> measure and improve your website speed

inserts 31KB JavaScript into tiny HTML pages.

by dchest

8/17/2026 at 7:56:44 AM

> "gives site owners actionable performance data they would not otherwise have"

As I understand, the next step will be to inject ads, to give CloudFlare actionable monetization strategies they would not otherwise have.

by jwr

8/17/2026 at 11:05:42 AM

That’s cool, make sure I see it however on the onboarding screens. Big green switches (Proxy, Web Analytics) that I have to scroll through to get to the Ok so I can turn them off there.

by stagas

8/17/2026 at 7:18:06 PM

Yeah not telling people you're doing the equivalent of css on their website is diabolical dude. You should be ashamed.

by swordsith

8/17/2026 at 7:25:02 AM

Is this even GDPR-compliant?

by sunaookami

8/17/2026 at 9:00:15 AM

> Rather than count unique IP addresses (requiring storing state about each visitor), we simply count page views that originate from a distinct referral or navigation event, avoiding the need to store information that might be considered personal data.

They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default.

You do your opinion

by hinata08

8/17/2026 at 11:12:56 AM

Just saw that in the dashboard: "Enable globally", "Exclude EU". Kinda funny (in a bad way)

by sunaookami

8/17/2026 at 11:39:07 AM

> they exclude EU visitors

GDPR is applicable on EU citizens, disregarding where they browse from. So either they have to track whether you're an EU citizen/EU visitor or they track EU visitors when browsing from outside of EU. This makes it not GDPR compliant.

The main issue is that your privacy policy is most likely not mentioning this third-party tracking because you were not even aware of it. Who is going to be responsible? Who is going to be fined for not mentioning this tracking in _your_ privacy policy? You. (Your company)

by Mystery-Machine

8/17/2026 at 1:07:33 PM

Fucking ass hats.

I'm impressed how quickly cloudflare went from nice to evil cunts.

by boesboes

8/16/2026 at 8:39:34 PM

An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com">

This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

by okzgn

8/17/2026 at 12:34:38 AM

If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that <meta> tag. The risk is not abated

The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1

CF somehow avoids the usual objections. CF is a MiTM but few people object

1. For example, a data collection, surveillance and advertising services company that operates a www search engine and releases a web browser may not want an ISP to inject scripts, etc., e.g., analytics, ads, etc., into web pages as it might compete with the company's business. As a defense against such ISPs and other third parties that are potential competitors for data collection/surveillance/advertising services, it might favor HTTPS sites in its www search engine results, promote HTTPS at conferences discussing its web browser, etc.

by 1vuio0pswjnm7

8/17/2026 at 2:28:07 AM

FWIW, I operate own DNS (including own custom root.zone) and I MiTM own TLS traffic with a localhost forward proxy. With this setup I get r/w access to response bodies, I add a CSP as an HTTP response header, and a long list of other traffic manipulation. There is no tracking, ads, telemetry, etc. Nothing leaves the computer unless I allow it. Operating DNS plus forward proxy gives me lots of control

Letting Cloudflare (CF) operate DNS and direct traffic through its proxies gives CF control

It's interesting to see how they use it under market pressures

by 1vuio0pswjnm7

8/17/2026 at 3:28:07 AM

This is a tangent, but your setup sounds interesting to me — would you share more about how to configure such for myself?

by zmgsabst

8/17/2026 at 5:40:13 AM

Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_

But this is what Cloudflare does and no one seems to mind

Large companies also do this to protect their LANs

I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all

The basic configuration is generally:

1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file

2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2

3. After doing the stuff, the proxy then sends the traffic over the internet

The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities

It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits

I rarely use a graphical browser, for example

I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS

When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat

After I saw that it worked, I started using other software like haproxy

I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www

It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks

It can be useful, IMHO

by 1vuio0pswjnm7

8/17/2026 at 12:19:37 PM

NB. I actually do not encrypt then re-encrypt for the majority of HTTP requests I make

I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs

I process response bodies, using own software, into SQL, CSV, simple HTML or plain text

I'm not using a graphical web browser to make HTTP requests

This design isn't for everybody, but it's what I strongly prefer

As such, in the way I use it, for the majority of HTTP traffic, no speed is sacrificed

There are a variety of proxies that can be used to forward traffic. I use only a small selection. The largest one I use is haproxy, the smallest one I use is tinyproxy. Personal preference will vary

The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefetences. Every user is different. Using a firewall to send traffic to the proxy is an alternative

The motivation for me was always experimentation, learning and control, not "privacy"

"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing

by 1vuio0pswjnm7

8/17/2026 at 6:59:36 PM

*preferences

by 1vuio0pswjnm7

8/17/2026 at 11:02:29 AM

This sounds like exactly the kind of thing I'd waste a weekend setting up but what do you actually do with the decrypted traffic? What do you inject? I know you said it's personal but maybe some basic ideas.

Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy?

In terms of the speed I doubt the time to decrypt and encrypt tls is noticeable in modern times, especially given how slow websites have become. It's not like a load balanced website behind cloudflare isn't already doing this 3 times

by dwedge

8/17/2026 at 3:48:49 PM

"... but what do you actually do with the decrypted traffic?"

I read it

On the most basic level, consider logging

I can add response headers with additional information about the request and these are stored in the log

I can create a comprehensive log of every HTTP request, stored in a text file or SQL database

I store these logs in an unpopular compression format that allows searching tar'd and compressed files using regex without decompressing them

(This is not possible using zstd, gzip, etc.)

I use this "browsing history" with a variety of programs

Compare this with the design paradigm of storing history inside each individual program, as is the case with a so-called "modern" graphical web browser

Other basic proxy functions that I use are (a) control over HTTP headers, including cookies, (b) control over TLS settings, including SNI, and (c) rewriting URLs

The settings are site-specific and/or URL-specific. Lists of websites that have special requirements, e.g., need for SNI, specific HTTP headers, TLS version, HTTP versions, etc., are stored in text files. These are mapped into the proxy's memory. Not every website has the same requirements

I also use CDN IP address ranges to make decisions about what requirements a website might have

Compare this with trying to control these things from within each individual program. In some cases, it is not possible. Or compare with trying to control these things with Javascript. Generally I don't use a graphical browser. Nor do I use NodeJS. I use Lua. As such, Javascript is not the best solution for me

Having lists of which websites have some specific requirement(s) allows me to learn about the sites I visit in ways that a so-called "modern" web browser does not

The same goes for controlling DNS. I learn about where website operators outsource DNS, how DNS providers (mis)configure their services and when DNS data changes or remains static for years

Perhaps the most important proxy function for me is the ability to avoid DNS lookups. The IP address data is stored in an SQL database using a simple, custom format, extracted to a text file and mapped into the proxy's memory

Using a proxy allowed me to move away from storing DNS data in, and serving it from, zone files

This is only a partial list of functions that I use. I like to experiment

Proxies today can do much more than basic functions like the ones I mentioned

For example, injecting Javascript or modifying an HTML tag before it reaches a browser is trivial, albeit inefficient from a purist perspective

This is not something I need to do most of the time. I have relatively simple needs. Most times, I'm not using a graphical browser. I'm using the command line in textmode, no X11, etc.

Cloudflare has a different use case

What does Cloudflare actually do with the decrypted traffic. Only CF knows

by 1vuio0pswjnm7

8/18/2026 at 4:34:03 PM

The forward proxy also allows me to mix and match TCP clients with various SSL libraries

The so-called "modern" browser is generally tied to a single SSL library

It's possible to compile curl with several different SSL libraries, but I prefer TCP clients over HTTP clients; curl is more limited than the programs I use to generate HTTP, it's slower

by 1vuio0pswjnm7

8/17/2026 at 10:45:07 AM

How much speed are you actually sacrificing? I'd assume modern hardware can decrypt/encrypt TLS very fast.

Side note: I remember working for a company in early 2000's that had Sparc III 1U servers we had to buy crypto accelerators to do this until I had to convince them to use dell/linux.

by mlrtime

8/17/2026 at 11:20:27 AM

Just out of curiosity, which proxy do you use?

by phrotoma

8/17/2026 at 1:06:18 AM

Thanks for the background context, very interesting and realistic. Yes, of course it also has read/write access, though I always make sure there’s no interference of that kind. It has only happened to me once, where a binary I hosted on Pages didn't work when downloaded with wget (though that happened several years ago).

by okzgn

8/17/2026 at 1:45:45 AM

Also can add "Cache-Control: no-transform" header, which prevents modifying the payload.

by pcmaffey

8/17/2026 at 2:36:49 AM

Does it prevent it? Or just request it? There's no way to enforce that is there?

by hahn-kev

8/17/2026 at 3:31:37 AM

CF owns it all, coming and going (request handling and response writing), thus can choose how/whether to interpret, ignore, modify or append any headers.

by chrisweekly

8/17/2026 at 6:49:03 AM

script-src 'none' is a more secure solution.

by robin_reala

8/17/2026 at 12:41:09 PM

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it.

So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla.....

Edit to add:

I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere in Firefox ?

When I first wanted to check, I visited `cloudflare.com` as it seemed the obvious place to find `static.cloudflareinsights.com` and Firefox shield blocks nothing there (hence I made this post)

However, then I tried to find a different site, and after a bit of random searching/clicking around I found `www.tenforums.com` and `static.cloudflareinsights.com` is blocked on there.

Its not a first-party domain thing, since cloudflare.com != cloudflareinsights.com.

Surely `static.cloudflareinsights.com` should be blocked everywhere in strict mode, no exceptions ?

Interestingly, when testing other sites, I have also been discovering other things Firefox shield is failing to block, e.g. `browser.events.data.microsoft.com` (tested on a non microsoft.com site)

by traceroute66

8/17/2026 at 12:51:29 PM

Standard, Strict or Custom? Strict should block that one for sure, will check once at home.

by Topfi

8/17/2026 at 1:13:53 PM

I just double checked `about:preferences#privacy` is "Enhanced Tracking Protection: Strict" and clicking "Advanced Settings" confirms the radio button is indeed under "Strict".

Firefox 153.0.4

by traceroute66

8/17/2026 at 2:32:08 PM

Just saw the edit, all clicked now. As described this is expected behavior. The entitieslist (can't link right now because Github is down but got a local copy for some experiments) contains exceptions for owners of tracking URLs, in this case as a resource for Cloudflare.com and others owned by them only. Basically, because they are the same entity, they are considered one. Whether that could be communicated better by upstream, that's worth a discussion. Anyone besides Cloudflare.com has cloudflareinsights blocked.

Here the specific entry for context from my local copy of ESR 153:

{

  "entities": {

    "Cloudflare": {

      "properties": [

        "cloudflare-quic.com",

        "cloudflare.com",

        "cloudflare.tv",

        "cloudflarestatus.com",

        "cloudflareworkers.com"

      ],

      "resources": [

        "cloudflare.com",

        "cloudflareinsights.com",

        "cloudflarestream.com"

      ]

    }

  }
}

On a side note, spent a while learning how upstream Firefox works in-depth over the last few months, if ETP didn't block cloudflareinsights on pages outside Cloudflare.com I'd have lost any confidence build up and my project would likely linger even longer. Might just add a setting that totally excludes such exceptions if I can properly test it before release, seems there might be demand. Admittedly more for UX and honest communication clarity reasons (top setting truly prevents everything) then privacy, not the main goal of Hominis as a project.

by Topfi

8/17/2026 at 2:41:59 PM

Yeah, I was trying to get hold of the list from Github myself before posting the edit. It is unfortunate strict isn't truly strict, but at least now I know. Thanks for that.

Pending Github fixing itself, could you confirm if `browser.events.data.microsoft.com` is on your local copy ?

by traceroute66

8/17/2026 at 3:03:59 PM

Yeah, agree, purely from a user expectation perspective, strict sounds like it'd suppress everything, not just third-party, especially with lower compatibility turned on.

Yeah "browser.events.data.microsoft.com" is in, but mainly because it just ends up under microsoft.com anyways, subdomains are accepted inside the entitieslist.

Here the full copy (initially wanted to share via Pastebin but some links triggered a spam filter): https://cdn.jsdelivr.net/gh/mozilla-services/shavar-prod-lis...

If you or anyone else reading is interested, Mozilla has written some pleasant docs, lots to learn, easy to understand, comprehensive. Could not even consider what I am attempting without the resources they've provided: https://firefox-source-docs.mozilla.org/toolkit/components/a...

by Topfi

8/17/2026 at 1:10:21 PM

I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

by kg

8/17/2026 at 1:36:02 PM

> I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

I also daily-drive Brave and Mullvad browsers, both of which correctly block `static.cloudflareinsights.com` and I never have issues with Cloudflare sites.

by traceroute66

8/17/2026 at 12:52:36 PM

cloudflareinsights.com seems to be part of their list. If you see unexpected tracking, it could be worth reporting it to Mozilla.

by cryptonym

8/16/2026 at 7:32:07 PM

Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

by dchest

8/16/2026 at 9:15:40 PM

If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?

You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.

by kazinator

8/17/2026 at 3:39:38 AM

The OP doesn't understand what they are configuring they have Cloudflare setup as a proxy.

by tick_tock_tick

8/16/2026 at 9:55:15 PM

The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.

by hackernud3s

8/17/2026 at 1:30:44 AM

I have no idea what 'the orange cloud icon' means, as I'm not a CloudFlare used.

But DNS/Name servers do not see HTML traffic, as the above poster mentioned, so it's not obvious how this change would matter.

Is it that they are serving their HTML via CloudFlare, and cloudflare is making changing in its serving of their html?

by ____tom____

8/17/2026 at 2:10:22 AM

Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.

by supermdguy

8/17/2026 at 2:59:52 AM

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

by vickychijwani

8/17/2026 at 3:31:24 AM

That's how you get DDOS protection / edge delivery, so it's not a dark pattern. I imagine it's the main reason why people would DNS through them in the first place.

by hackernud3s

8/17/2026 at 3:52:13 AM

An “orange cloud” with no other indication to represent a feature that is enabled-by-default (with implicitly enabled analytics) sounds like quite the dark pattern. The UI makes the DNS record seem to point to A (your entry) but actually points to B (Cloudflare). This isn’t an oversight, it’s an attempt to obfuscate.

Even if the choice to enable it by default makes sense for Cloudflare’s userbase, the implications are hidden and non-obvious.

by vickychijwani

8/17/2026 at 5:32:21 AM

It's essentially the entire reason to use Cloudflare.

As sibling mentions it is indeed labeled and not just some icon. People just refer to the orange cloud UI for it for convenience and because it makes it easy to spot whether you have it on or not.

But regarding the icon, the icon is their company logo, it really is the primary feature. It's also not like you have to go find it in settings to turn it off after adding DNS record, it's part of the form when you add the record (default on, yes), and it's prominent when viewing the record.

by furyofantares

8/17/2026 at 12:00:20 PM

I don't buy that, there is no reason for 99.9999% of sites to use cloudflare.

The "reason" to use cloudflare is hype.

by tjoff

8/17/2026 at 2:01:34 PM

It's the reason for its existence and the reason people are choosing it. If they are making a mistake, hoodwinked by hype, that's totally unrelated to the point being discussed. I think you've just seized the opportunity to post your disdain for them without regard to the actual topic being discussed.

by furyofantares

8/17/2026 at 2:56:41 PM

Truly doubt that. Sure, but if they are making a mistake due to dark patterns then it is another thing.

This thread does indicate the latter.

by tjoff

8/17/2026 at 11:42:33 PM

You don't think there's value in hiding origin ip from hackers? lol.

by hackernud3s

8/18/2026 at 7:07:31 AM

If you are self-hosting, sure. Otherwise, mostly no.

by tjoff

8/17/2026 at 5:07:11 AM

The options are actually labelled as 'Proxied' or 'DNS Only', so that is actually quite clear.

by mjmas

8/17/2026 at 7:02:44 AM

That’s not a dark pattern. That’s one of the core reasons to use Cloudflare.

by EtienneK

8/17/2026 at 11:20:38 AM

And of course by extension it is also one of the core reasons not to use Cloudflare.

by 6031769

8/17/2026 at 4:11:04 AM

I would say that Cloudfare having customers who don't know exactly what they are getting (into) is actually a Cloudfare problem they should take responsibility for.

by kazinator

8/17/2026 at 9:04:08 AM

I would say its up to the user to research what they are using.

by alt227

8/16/2026 at 9:26:13 PM

This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either </body> or </html>, can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).

by userbinator

8/17/2026 at 12:55:12 AM

I'm getting flashbacks to Proxomitron, a localhost proxy in the HTTP days when it was also much harder/impossible to make browser plugins.

by Terr_

8/17/2026 at 1:17:29 PM

Hacker News already knows, nobody gave shit when they first announced it. I assume because it didn't have AI in the title?

https://news.ycombinator.com/item?id=45291323

by ChoGGi

8/17/2026 at 2:19:18 PM

I think it has more to do with the title sounding positive and not causing a stir to avoid controversy, maybe.

by docmars

8/16/2026 at 8:11:11 PM

Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.

I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

by outlines

8/16/2026 at 8:12:46 PM

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

by stagas

8/16/2026 at 9:42:07 PM

I agree it is a bit confusing, but it makes sense if you think about the expected default use case, which is enabling the cloudflare CDN for customers. They expect people to be using their CDN.

I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN.

Once you figure it out, it is fairly straightforward, though, and you can’t beat the price.

by cortesoft

8/17/2026 at 6:27:42 AM

If a registrar requires you to use their own nameservers, then they are no longer comparable to other registries.

by Ayesh

8/17/2026 at 8:12:25 AM

With the supply chain attacks happening in the JS ecosystem, this reminds me to advise against using CDN's.

by prophesi

8/16/2026 at 8:35:37 PM

> that also should have been opt-in.

The proxy is like 99% of why people use Cloudflare

by TiredOfLife

8/16/2026 at 8:41:39 PM

A simple screen when I did the switch that requires explicitly ‘Enable Proxy’ or ‘skip for now’ would have been enough. Also for ‘Enable Analytics’. None of these existed, or not very obvious otherwise I’d seen them.

by stagas

8/17/2026 at 7:14:55 AM

In the DNS screen there is literally a column "proxy status" with the only color besides black and white being the orange of proxy enabled

by TiredOfLife

8/16/2026 at 7:14:32 PM

Yikes! I see this too:

<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>

by purpleidea

8/16/2026 at 8:27:31 PM

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

by kevincox

8/17/2026 at 2:07:28 AM

MITM attack, that's what it is. Why is this not in the news? Ah, no one cares.

by zx8080

8/17/2026 at 4:35:25 AM

It takes a lot of trust to let a CDN be able to terminate TLS traffic for you and this doesn't exactly give the warm fuzzies.

by zeafoamrun

8/17/2026 at 2:32:40 AM

Why is this not in the news?

Good point. There should be a place where hackers can get this kind of news. Some kind of Hacker News place.

by reaperducer

8/18/2026 at 10:12:39 AM

Cloudflare is essentially MITM as a service. What else would someone expect?

by ironmagma

8/17/2026 at 3:35:58 AM

Adding a RUM beacon for observability / performance metrics capture, as an opt-out feature for free plans (opt-in for paid plans), is not exactly nefarious. Hopefully/presumably there was some communication before the change was rolled out.

by chrisweekly

8/17/2026 at 3:58:12 AM

No. I was on a free plan for years and found out by accident. It's interesting that you set "nefarious" as the bar. I'd simply call it "sleazy".

by matherial

8/17/2026 at 1:35:46 AM

I'm not seeing this on my site (if you want to check: https://stackgho.st), are you using their `strict` http settings? I.e. is your server terminating TLS or is theirs?

edit: perhaps it's only for sites added after that policy came into effect

by stackghost

8/17/2026 at 9:59:08 AM

If you're using free hosting and allowing that provider to mitm your origin's traffic, it seems a little naive to assume they wont eventually submit to temptation and start doing something like this.

by corford

8/16/2026 at 7:06:17 PM

Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.

by windexh8er

8/16/2026 at 7:35:55 PM

They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.

by JoshTriplett

8/17/2026 at 12:25:38 PM

I understand how it technically could work. My response was more centric to the fact that CF has been doing this for a long time and you should probably know better when selecting a vendor / feature like this.

Again, this isn't anything new.

by windexh8er

8/16/2026 at 7:41:41 PM

100% But this does not give you any useful personal data :)

by sscaryterry

8/16/2026 at 7:43:09 PM

Or data for the increasingly invasive Cloudflare captcha.

by JoshTriplett

8/16/2026 at 7:12:04 PM

Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

by celsoazevedo

8/16/2026 at 8:11:26 PM

No, I hadn’t enabled for any site. I had to enable first to turn it off.

by stagas

8/17/2026 at 12:24:14 AM

Maybe send it to them as a bug. Seems more like a mistake than malevolence.

by nilram

8/17/2026 at 7:11:05 AM

They have a blog post about it so they know what they're doing.

by PlotCitizen

8/16/2026 at 8:13:39 PM

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc

Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?

Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

by Animats

8/16/2026 at 8:26:21 PM

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing.

It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

by bawolff

8/16/2026 at 9:29:46 PM

When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently forward everything via Cloudflare. This is probably where the analytics get inserted, alongside a bunch of other Cloudflare features.

You can disable this, at which point the record will be set as a normal DNS record.

I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.

by MrJohz

8/16/2026 at 11:04:07 PM

On the other hand. Proxying websites (for ddos protection, cdn, etc) is their primary product. Its what they are known for.

I think a better question is: why would you be using cloudflare, if you didn't want that?

by bawolff

8/19/2026 at 6:41:22 PM

In this case, I was specifically using the domain registrar product from Cloudflare alongside other tools. Later, I moved a bunch of stuff away from Cloudflare but kept using them to manage my domains for the convenience — as part of that move, I ran into this issue.

I agree that it makes sense to link products together ("vertical integration" and all that), but I think it's very confusing to have a DNS dashboard that lets you configure DNS how you like, but then by default doesn't set up the DNS as you configured it. That's a weird choice.

by MrJohz

8/17/2026 at 3:00:19 AM

There's still a naive expectation that the proxy isn't going to inject invisible content on your site that hits when you realize you were being naive.

by fragmede

8/16/2026 at 9:57:45 PM

>I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.

You could say the same about the reverse, ie. people set up their site on cloudflare, thought it was "protected", but really it's dns only and their servers are wide open. It's even worse if they migrated from another provider that was providing ddos protection.

by gruez

8/19/2026 at 6:45:32 PM

I don't think this particular feature helps there, though. If you set your site up on Cloudflare, you'll probably explicitly want the proxy stuff, and that's very easy to set up. But if you buy a domain on Cloudflare, then you're already not looking specifically at the proxy products, you're looking at something else. And if you start configuring that domain in an admin panel that looks like it's offering you direct DNS configuration, and then you later realise that the DNS configuration has ended up completely different to how you set it up, then that's a bit weird. Like, if I set `CNAME` in DNS, then I expect the DNS CNAME record to be what I set it to.

by MrJohz

8/17/2026 at 12:56:27 AM

> It seems incredibly unlikely cloudflare does this when just DNS hosting

Not to mention impossible when ‘just’ DNS hosting. Though I suppose they could secretly replace the stated IP with one of their own anyway and then still proxy the content.

by Aeolun

8/16/2026 at 9:21:33 PM

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch?

Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

by kazinator

8/16/2026 at 11:08:32 PM

Yes, the person who controls the DNS controls the certificate.

What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate.

This isn't an edge case though. This is cloudflare's primary product. It is why users use them.

by bawolff

8/16/2026 at 10:12:45 PM

As far as I know they terminate all TLS; it’s one of the tradeoffs using them.

by threecheese

8/16/2026 at 11:57:36 PM

They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to.

This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.

by muvlon

8/17/2026 at 1:26:29 AM

Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work.

Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.

by bawolff

8/17/2026 at 4:45:21 PM

Nope, you don't need your own AS for this to work, nor do you need to use BGP. They support static routes too. BGP peering support is actually "beta" according to Cloudflare: https://developers.cloudflare.com/magic-transit/get-started/...

You do ideally want your own /24, though even that's not a hard requirement. And it can be provider-assigned space as long as your provider is willing to sign an LOA for you.

As for competitors, there are a few that start in the low 4 digits per month for similar services. That's not to say Cloudflare doesn't have anything unique to offer though, they're great at scale and standardization.

by muvlon

8/17/2026 at 10:31:58 PM

would a provider really be willing to sign an LoA for you in that situation? That seems like a hard ask, but admittedly this is out of my depth.

by bawolff

8/16/2026 at 8:28:20 PM

I can’t recall if there was a setting to enable reverse proxy, if there was it was On by default since I didn’t expect to have reverse proxy enabled as well. But you can also rp without injecting a script. That’s overdoing it.

by stagas

8/16/2026 at 9:26:22 PM

If the cloud symbol is orange, it's enabled. I believe they'll even warn you if you disable it, a lot of people enable it unintentionally.

by eaf7e281

8/16/2026 at 9:01:11 PM

I don't know what happened in this situation but beware that CF and similar providers are not true DNS hosting providers. They do DNS, but only so their CDN stuff works, and to lock their customers from using whatever DNS hosting they want. Various things that one might reasonably want to do with your DNS zone are not possible with their product. So use it only because you need to do so in conjunction with their core services.

by dboreham

8/16/2026 at 8:37:22 PM

TLS terminates at Cloudflare, not at your origin. When a record is proxied (the orange cloud), CF holds the certificate the browser validates against and opens a separate connection to your server, so it sees plaintext on both sides and can rewrite the HTML on the way out. Same mechanism that makes the WAF and caching work, so it isn't specific to the analytics feature.

Worth checking which of your records are actually proxied. DNS-only ones (grey cloud) pass straight through and can't be touched.

by Touchnow

8/16/2026 at 7:32:11 PM

You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

by pudgywalsh

8/16/2026 at 7:57:22 PM

Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?

by stagas

8/16/2026 at 9:26:37 PM

The main reason anyone chooses cloudflare is for their CDN (which I suppose is a "reverse proxy"...not a way I'd refer to it but technically yes that's essentially what it's doing). If you don't need the CDN or any of the other fancy features there are plenty of straight DNS providers out there (and often provided by the registar these days).

by temp0826

8/16/2026 at 8:09:54 PM

Ok to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).

by stagas

8/16/2026 at 9:23:44 PM

OK, how can Cloudfare edit your HTML without it passing through your server?

If the browser connects directly to your web server, how can there be Cloudfare's analytics stuff?

Check what IP address you are connecting to when you load textlog.cc. Is that an address that you control? If it's not an address that you control, where is it getting your page, and is that not called proxying?

by kazinator

8/16/2026 at 7:39:27 PM

Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.

by johntash

8/16/2026 at 9:53:47 PM

"can't" is incorrect. As your name server, they can decide to turn the reverse proxy/caching at any point in the future, write an obscure blog post about how this is the best solution for all (a post that gets 2 comments on HN due to other news that week), and you'd only find out about it 11 months later in a thread like this one.

by sebastiennight

8/17/2026 at 4:01:59 AM

Why would they snoop your traffic?

Ah, because they can.

by camel_gopher

8/16/2026 at 7:25:15 PM

Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.

by ValentineC

8/17/2026 at 1:34:05 AM

What else would you expect from Cloudflare?

It this point in time it is somewhere between GoDaddy and RyanAir in dark pattern usage

by jesterson

8/16/2026 at 9:17:51 PM

I noticed the same thing with email-decode.min.js on my site. It turns out it's the "Email Address Obfuscation" feature, which I didn't expect to be on by default.

by sparsesignal

8/17/2026 at 8:17:03 AM

You are using MITM proxy as a service. In addition to analyzing all traffic and blocking legitimate users with captchas, they can inject stuff in there, too.

by neop1x

8/17/2026 at 9:21:58 AM

Unsuspecting reader: if you think this comment is interesting please search "deCloudflare" and "crimeflare" on the Internet. The repo is abandoned but it's still regularly taken down whenever it's uploaded. Cloudflare is literally the GFW of the world, is involved in a lot of suspicious activities and a huge danger to future of the open web. The company started as an intelligence honeypot service originally got funded by DHS in '08. You can DYOR on how things moved on from there.

This one hasn't been taken out yet: https://gitlab.lain.la/dCF/deCloudflare/-/blob/master/readme...

The taken down versions of the repo usually link here: https://en.wikipedia.org/wiki/Wikipedia:Uphill_battles

by anon5739483

8/16/2026 at 8:52:11 PM

Thank you for this. I indeed had it up on mine. Cloudflare has switched defaults a couple times now, which honestly is wild to me.

by jjcm

8/16/2026 at 7:03:49 PM

To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.

by csomar

8/19/2026 at 1:42:26 PM

I keep wondering when the other shoe will drop on the idea of this one company MITMing a large portion of the world's internet traffic.

by tdeck

8/16/2026 at 7:34:58 PM

yep, last website I did was JS free 100% except that pesky cloudflare script

by BorisMelnik

8/18/2026 at 4:14:17 PM

Cloudflare is also now actioning DMCA requests and blocking site pages. Returning an Error 451 - Unavailable For Legal Reasons.

by TheqO

8/17/2026 at 6:21:07 AM

Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.

by the4anoni

8/17/2026 at 9:05:54 AM

Cloudflare used to effectively allow you to block users coming from Tor or proxies, forcing them to chose between not visiting your site or disabling their privacy features. (when Akamai was able to still allow legitimate users)

They do a much better job these days, at least

by hinata08

8/17/2026 at 7:09:50 AM

There are countless objections to many of the things the Cloudflare is doing. If you only need it for a small number of things perhaps it may be worthwhile to look if at whether there are alternatives to CF for those use cases.

by PlotCitizen

8/17/2026 at 1:19:54 PM

How could we ever find which hosting has ever changed the output html / files it sent ?

How could we guarantee that the hosting service is only hosting ?

by ttoinou

8/16/2026 at 8:59:45 PM

Spies. Spies everywhere

by p0w3n3d

8/16/2026 at 8:43:07 PM

It's not necessary to use Cloudflare hosted DNS to use R2 with a custom subdomain.

Make a CNAME record the same way you would for a CDN subdomain.

(I am not yet running this in production, YMMV.)

by Symbiote

8/16/2026 at 9:57:06 PM

Then you don't get edge cache though, right? And maybe some other features?

by hackernud3s

8/17/2026 at 9:06:47 AM

The benefit of not being MITM'd by Cloudflare is probably worth it in many cases.

by johneth

8/16/2026 at 7:39:40 PM

Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.

by minraws

8/17/2026 at 8:10:00 AM

If you navigate to the domain itself, then to Analytics > Web Analytics there's a Quick Action for the RUM Settings.

by eXpl0it3r

8/17/2026 at 8:34:11 AM

Personally not sure what the concern is unless you only use Cloudflare for DNS only.

They see everything that passes through their proxy, and if they wanted to perform analysis on a site they're interested in I really wouldn't be surprised if there's a clause in the ToS that allows them to do it.

by CommanderData

8/16/2026 at 9:58:01 PM

A public service reminder to anyone setting up their domains that there are many alternatives to Cloudflare, like EG Bunny.net (I am not affiliated, just a happy customer) and that by using one of these other DNS providers, you

- play your small part in keeping the Internet open

- delay or avoid entirely the enshittification that is 100% foreseeable when buying the "free" services of a quasi-monopoly vendor.

If you're not an enterprise customer, alternate providers will also give you every single feature you could ever need and more, and fewer surprises like the OP's.

by sebastiennight

8/17/2026 at 5:16:14 AM

if you aren't paying, you aren't buying

by mbravorus

8/17/2026 at 3:26:38 AM

Why do people care? This is hardly anything malicious.

by deadbabe

8/17/2026 at 8:17:24 AM

Hardly anything malicious ... yet and even that's debatable.

Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaScript without you knowing or having done anything.

Additionally, this introduces additional tracking of users, which a lot of people don't want.

And finally, there's the slippery slope. Today it's RUM, tomorrow it's ads or something else? Once CF starts modifying the user's content, what's stopping them from doing it more and more?

by eXpl0it3r

8/17/2026 at 1:58:35 PM

Slippery slope doesn’t apply here, because at the point the slope becomes too slippery, you can just get off and find a new solution. Maybe you don’t proxy at all.

For now, a pure JavaScript free site and a JavaScript-free-except-a-bit-of-analytics does not make meaningful difference to visitors of the site. The benefits of proxying are more important.

by deadbabe

8/17/2026 at 2:01:43 PM

CF tested the water with polyfill.io 2 years ago. Everyone liked them modifying user's content. We are now on the "more and more" side.

by cryptonym

8/17/2026 at 12:09:40 PM

Say I'm a vegetarian restaurant, and I contract out my delivery service.

One day the delivery service starts adding free sausages to every delivery on an opt-out basis.

By the time you realize, they'll already have delivered adulterated meals. You won't have a lot of customers left!

People are often vegetarian for ethical reasons. In a similar way, many people have Ethical Opinions (tm) about Analytics as well. They don't like it when other people collect private information about themselves, and refuse to Do Unto Others.

But even if you're fine with analytics in general: When intermediaries and other transitive dependencies (like software libraries) start injecting analytics on an opt-out basis, you simply can't control what's going on. And that's before we talk about the ethics and legality of third parties modifying content in-flight.

In the EU, the law actually codifies the ethics at play here (GDPR). Several people point out that cloudflare disables this 'feature' for the EU. This makes a lot of sense, because it would have been a huge mess for everyone impacted to have to go to their customers with a "sorry, we leaked your PII, here's how we'll make you whole"; as well as possibly lawsuits against cloudflare to recover those damages upstream.

by Kim_Bruning

8/17/2026 at 1:57:18 PM

For delivery service, it's typically done with a closed box so you get exactly what has been prepared.

Here you told them to unpack the food and repack it (TLS termination), filtering order (WAF), reheating pre-made food (cache) and they offer service to even prepare food or part of the food (edge compute). When your food is not available they will serve their own (error pages), with their brand visible. At that level of service, it's not so surprising to have extra stuff included.

If you are vegan and care about your customers (conservative on data collection and JS), maybe you should use a vegan architecture and not give your last-mile to the cheapest (free-tier) all-purpose repacking kitchen and delivery service.

by cryptonym

8/17/2026 at 5:42:49 PM

> If you are vegan and care about your customers (conservative on data collection and JS), maybe you should use a vegan architecture and not give your last-mile to the cheapest (free-tier) all-purpose repacking kitchen and delivery service.

Right, that's the lesson being learned here today.

To be fair, up 'till now, afaik these services actually have been trustworthy on this count, so this is a new low.

Just because people extend you a lot of trust to do A,B, and C doesn't mean you can't lose it if you randomly start doing D instead.

I don't think we can run a viable (high trust) western economy if we constantly have to beware of our own providers. Principle of least surprise applies.

by Kim_Bruning

8/17/2026 at 12:05:57 AM

cloudflare is malware, what did you expect?

by sitzkrieg

8/17/2026 at 3:07:34 AM

No it's not. You don't have to like them, but malware is "any program or file built to damage, disrupt, or secretly gain access to a computer, phone, or network". Cloudflare is many things, some good, some bad, but they don't secretly gain access to your system, you have to choose to install it, so it's not malware.

by fragmede

8/17/2026 at 7:19:43 AM

You choose to install it on your website if you own a website, but if you're surfing the world wide web, then a lot of the places you visit are increasingly being gatekept/hidden behind Cloudflare pages meant to "challenge" you if you take anti-fingerprinting measures.

Presumably these include any measures which would counter their operating model of tracking users on the web, under the excuse of stopping bots.

by PlotCitizen

8/17/2026 at 9:19:40 AM

>they don't secretly gain access to your system

They are only "enabling Web Analytics by default" "by providing a powerful, in-depth monitoring solution that helps you debug and optimize applications" when users do not come from the EU

Cloudflare is doing a great job most of the time, but I feel like this feature was speed run through approvals and could use more discussions

by hinata08

8/17/2026 at 7:55:32 AM

Here we go. First, get everyone on the internet to use a free service (nameservers and CDN caching, which BTW is mostly unnecessary for pretty much everyone out there). Then, inject analytics, to "give site owners actionable performance data they would not otherwise have". Then, inject ads.

In the meantime, also implement "bot protection" and get everyone on the internet to outsource the decision on who can access their website. With no appeal.

I'm increasingly worried about Cloudflare.

by jwr

8/16/2026 at 7:20:59 PM

Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?

by moktonar

8/16/2026 at 7:35:54 PM

If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.

by _def

8/16/2026 at 7:54:37 PM

Cloudflare is doing this already. Once they had enough monopoly power, they started a program to block all bots that don't undergo invasive KYC procedures. Eventually, they might become a KYC broker for regular browser users too. The free internet is over.

by LoganDark

8/17/2026 at 10:07:40 AM

Cloudflare will be linked into personal ID soon.

by nephihaha

8/16/2026 at 7:57:45 PM

#savetheinternet

by sssilver

8/16/2026 at 9:22:46 PM

That's exactly what they are.

And they can fuck off.

by cryo32

8/19/2026 at 1:53:28 PM

I'm curious which governments have spies within CloudFlare.

by tdeck

8/17/2026 at 3:57:34 AM

Maybe don't use CF if you don't want someone fucking with what you're serving. It's their entire raison detre.

by denkmoon

8/17/2026 at 9:28:12 AM

you wanted the cloudflare, you got the cloudflare.

by endre

8/16/2026 at 8:09:07 PM

Noticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off

by yogorenapan

8/21/2026 at 12:54:12 PM

[dead]

by tmpsvc2695f5

8/16/2026 at 9:22:11 PM

[flagged]

by evalystai

8/18/2026 at 12:54:12 PM

[dead]

by tmpsvc2695f5

8/16/2026 at 8:26:09 PM

[flagged]

by monitorion

8/18/2026 at 6:54:12 AM

[dead]

by tmpsvc2695f5

8/17/2026 at 1:11:11 PM

[dead]

by T3RMINATED

8/17/2026 at 9:35:54 AM

[flagged]

by ozereray1