Cloudflare injects analytics on nameserver switch
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Cloudflare silently injects its analytics script into sites when users switch nameservers. Users must opt out, raising privacy and transparency concerns.
Background
Cloudflare's Web Analytics automatic setup uses an edge HTML rewrite to inject a JavaScript snippet (beacon.min.js) into HTML responses. This happens when a site is proxied through Cloudflare, often after a user switches nameservers to Cloudflare. The injection is silent, and the only way to disable it is to first add the site to Web Analytics, then toggle off the snippet. This has sparked discussion on Hacker News about the invasiveness of opt-out versus opt-in features.
How it unfolded
- Aug 16, 2026A user on Hacker News reports that after switching nameservers to Cloudflare, their HTML-only site had a JS analytics snippet injected silently.
- Aug 16, 2026The Hacker News post gains traction with 310 points and 78 comments, with users discussing the proxy behavior and the need for clearer disclosure.
- Aug 17, 2026A blog post explains how to remove beacon.min.js, noting that the disable toggle only appears after adding the site to Web Analytics, and that 'no-transform' is a stronger lever.
Who’s saying what
- User
- The original poster calls the injection 'entirely invasive' and argues that features like this should be opt-in, not opt-out.
- Commenter
- Some commenters note that the injection only occurs when Cloudflare terminates HTTPS (proxying), and that users can disable it, but wish Cloudflare were clearer about when proxying is used.
- Blogger
- A technical blog post explains the mechanism and provides a workaround, emphasizing that the dashboard route is 'inverted' and that 'no-transform' is a stronger lever.
Still unverified
The claim that Cloudflare 'silently' injects analytics is based on user reports and may not reflect all cases; the exact conditions under which injection occurs (e.g., only when proxying) are not fully confirmed by Cloudflare.