Cloudflare silently injects analytics code when you switch DNS

Switching your DNS to Cloudflare might come with an unexpected extra: an automatically injected tracking script.

A developer on Hacker News noticed Cloudflare quietly inserted a JavaScript analytics snippet into their site, textlog.cc, after they switched nameservers. The owner had moved DNS to route a custom subdomain to Cloudflare R2 storage, expecting their HTML-only site to stay completely script-free. Instead, they had to open the Cloudflare Analytics dashboard, register the domain, and manually turn off the script.

Why it matters: Default settings shape the web. When a DNS provider modifies page source code without asking, it turns a simple infrastructure switch into an invasive opt-out process.

If you recently pointed nameservers to Cloudflare, inspect your site's raw HTML source code. To turn the snippet off, claim the site inside your Analytics dashboard settings and toggle off the injected tracking code.

Your zero-JavaScript site might not be zero-JavaScript until you go hunting through dashboard menus.