Cloudflare Injects JavaScript Analytics Into JS-Free Website
A minimalist site owner reports that Cloudflare automatically added a tracking snippet after a DNS switch, forcing a complex opt-out process.
Cloudflare automatically injected a JavaScript analytics snippet into a website specifically designed to be JS-free after the owner switched nameservers. The incident highlights a friction-filled opt-out process for a feature that fundamentally altered the site's technical architecture.
The owner of textlog.cc, a minimalist open-source microblogging platform, reported that the company injected a script known as `beacon.min.js` into their pages. The user had transitioned their DNS to Cloudflare specifically to enable R2 bucket serving via a subdomain. Because textlog.cc is built as a server-side rendered, HTML-only experience, the silent addition of JavaScript violated the site's core design constraints.
The Opt-Out Struggle
According to the site owner, disabling the injected code was not a straightforward process. The user reported that they were required to manually add the site to the Cloudflare Analytics dashboard before the option to disable the snippet even became available.
"It was also very hard, for me, to find the setting that disables this JavaScript," said the user, identified as csomar, in a report on Hacker News. The experience underscores a deployment model where users are opted into tracking features by default upon switching their nameservers.
Implications for Site Control
This incident raises concerns regarding the balance between automated feature deployment and user control. For the vast majority of modern websites, a small analytics script is negligible; however, for developers maintaining strict technical constraints—such as those building for accessibility, privacy, or extreme minimalism—such injections can be disruptive.
Critics argue that the approach is invasive, suggesting that analytics should be an opt-in feature rather than a default setting. As Cloudflare continues to expand its suite of edge services, the ability for a provider to modify the delivered HTML of a site without explicit consent remains a point of contention for those prioritizing total control over their frontend delivery.
What's Next
It remains to be seen if Cloudflare will adjust its onboarding flow to provide a clearer opt-in mechanism for analytics during the nameserver migration process. For now, users switching to Cloudflare who require a strictly JavaScript-free environment should verify their page source and check the Analytics dashboard settings immediately after migration to ensure no unauthorized scripts are being served.