Tell HN: Cloudflare silently injects its analytics when you switch nameservers
Points and comments are a snapshot, not live.
Cloudflare silently injects analytics JavaScript when users switch nameservers, even on JS-free sites.
A user switched nameservers to Cloudflare to serve R2 buckets via a subdomain and discovered Cloudflare had injected a JavaScript analytics snippet into their HTML-only, JS-free site (textlog.cc). To disable it, they had to enable analytics first, then disable the snippet. The user calls this invasive and argues such features should be opt-in, not opt-out, warning others who might not notice.
What commenters are saying
Many commenters confirm seeing the injected script even with analytics supposedly off, calling it invasive and a man-in-the-middle attack. Some note the proxy (orange cloud) is on by default and that Cloudflare can terminate TLS and modify content. A few defend it as known behavior for RUM telemetry on free plans, but most criticize the opt-out design and difficulty finding the setting. Some advise switching to DNS-only mode to prevent injection.