Tell HN: Cloudflare silently injects its analytics when you switch nameservers
Cloudflare is under fire for silently injecting a JavaScript analytics snippet into user websites upon nameserver migration, even for HTML-only sites. This 'opt-out' default behavior has sparked significant debate on Hacker News regarding user control, transparent business practices, and the ongoing 'enshittification' of web services. The incident highlights a tension between convenience and autonomy that resonates deeply with the developer community.
The Lowdown
A user migrating their nameservers to Cloudflare for R2 bucket serving discovered that Cloudflare had automatically injected a JavaScript analytics snippet into their otherwise JS-free website. This occurred without explicit opt-in, forcing the user to first enable the analytics dashboard feature to then disable the unwanted script.
Key points from the user's experience and subsequent findings include:
- The script (
beacon.min.js) was injected despite the site being designed as HTML-only and JS-free. - Disabling the analytics required navigating to the Cloudflare dashboard, enabling the feature, and then opting out.
- The injection occurs when the site is configured to use Cloudflare's proxying services (indicated by an 'orange cloud' in DNS settings), which is often a default or easily overlooked setting during initial setup.
- The user, like many, initially assumed that simply pointing nameservers to Cloudflare would not result in content modification.
This incident has served as a stark reminder for developers to carefully review default settings and understand the implications of using large infrastructure providers.
The Gossip
Proxying Predicament: The Orange Cloud Conundrum
Much of the discussion revolved around clarifying *how* Cloudflare could inject code. Commenters explained that this behavior only occurs when a site's traffic is proxied through Cloudflare (the 'orange cloud' setting in DNS records), not when it's purely using Cloudflare for DNS. However, many users pointed out that this proxying feature is often the default, or its implications are not clearly communicated, leading to unintentional content modification. There was a strong sentiment that such a significant alteration should always be opt-in, not opt-out.
Opt-Out Outrage: Enshittification Echoes
A dominant theme was the frustration with Cloudflare's 'opt-out' approach, labeling it 'invasive,' 'sketchy,' and a 'dark pattern.' Many commenters shared similar experiences of finding unexpected scripts or features enabled by default, requiring them to hunt for obscure settings to disable them. This practice was widely decried as contributing to the 'enshittification' of internet services, where user-friendly or 'free' services gradually degrade by adding unwanted features or reducing control over time.
Mitigations & Alternative Manifestos
Some users offered technical solutions to mitigate unexpected script injection, such as implementing strict Content Security Policies (CSP). Others advocated for exploring alternative DNS or CDN providers like Bunny.net, arguing that relying on 'free' services from quasi-monopolies inevitably leads to compromised control and features. This viewpoint emphasized the importance of supporting diverse providers to maintain an open and less 'enshittified' internet.
Cloudflare's Core Competency Clarification
A segment of the discussion defended Cloudflare's default proxying behavior by pointing out that traffic management, DDoS protection, and CDN services (which require proxying) are their primary offerings and the main reason most users choose them. These commenters suggested that users who only want DNS services might be misunderstanding Cloudflare's core value proposition, or that expecting 'DNS-only' without carefully checking settings runs counter to the typical Cloudflare user's intent.