Tell HN: Cloudflare silently injects its analytics when you switch nameservers
- ID
- 14717
- Status
- summarized
- Published
- 17 Aug 2026, 1:49 AM
- Fetched
- 19 Aug 2026, 1:57 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://news.ycombinator.com/item?id=49322107
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.0
- Created
- 19 Aug 2026, 1:58 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
A Hacker News user reports that switching nameservers to Cloudflare silently injected a Cloudflare Insights analytics JS beacon into their HTML-only, JS-free site. Other commenters confirm the same behavior on cached sites where analytics was explicitly turned off, and note that injection only happens when Cloudflare proxies traffic (the 'orange cloud'), not DNS-only mode.
Why it matters
If you proxy traffic through Cloudflare (orange cloud), check your rendered HTML for a static.cloudflareinsights.com beacon script — even on sites where you disabled analytics. Add a Content-Security-Policy script-src directive to block unwanted injected scripts, or switch DNS records to grey-cloud (DNS-only) if you don't need proxying.
Discussion angle
How many Malaysian startups default to Cloudflare proxying without realizing it modifies their HTML — and whether CSP headers should be a baseline requirement for any production site.