I switched my nameservers to Cloudflare to enable R2 bucket serving on my site textlog.cc. Immediately I discovered a JS analytics snippet silently added to my HTML‑only page. I had to go to the Analytics dashboard, add the site, and then disable the snippet. I find this approach intrusive; features should be opt‑in, not opt‑out.

Many of my other sites show the same behaviour even though I had analytics turned off. That’s because Cloudflare defaults to proxying (orange cloud) rather than DNS‑only. When proxying, Cloudflare terminates TLS, rewrites HTML, and injects scripts. I switched the records to DNS‑only siguently, which removed the injection. Cloudflare also automatically injects email‑decode.min.js for its Email Obfuscation feature.

The incident illustrates that Cloudflare DNS is not purely passive. It can modify content when acting as a reverse proxy, which erodes goodwill and complicates debugging. Users who only need DNS should set records to grey cloud and verify which records are proxied.

The case also highlights that Cloudflare’s default behaviour has shifted: previously the injection was not automatic, acredita 239 points on Hacker News, and the 1.1.1.1 DNS service is separate from the hosting service.