chore(site): allow the Cloudflare Web Analytics beacon through the CSP - #201
Merged
Conversation
The site ships no analytics at all, so there is no way to tell whether anyone reads it. Cloudflare Web Analytics is the cheapest honest answer for a Pages-hosted site: cookie-free, no consent banner, first-party beacon, and it is not blocked as aggressively as GA by the ad blockers this audience runs. Enabling it on the Pages project injects the beacon script at the edge, which the current `script-src 'self'` policy would silently drop. Widen script-src to static.cloudflareinsights.com and connect-src to cloudflareinsights.com — the two hosts the beacon needs, nothing else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The site has no analytics of any kind, so we cannot tell whether the
promotion work is reaching real people or which pages they read. This is
P0 of the promotion plan: measurement before promotion.
Cloudflare Web Analytics is the right first tool here — the site already
runs on Cloudflare Pages, it is cookie-free (no consent banner), and its
first-party beacon is not blocked as widely as Google Analytics by the ad
blockers a developer audience runs.
What
One line in
site/public/_headers:script-src+=https://static.cloudflareinsights.com— the beacon thatthe Pages project injects into every HTML response at the edge.
connect-src+=https://cloudflareinsights.com— where the beacon POSTsits measurements.
Without this the current
script-src 'self'blocks the injected tag and theanalytics dashboard would just report zero forever.
Nothing else is widened: no cookies, no ad network, no third-party images or
styles.
Ordering
This has to land on
mainbefore the Web Analytics toggle is flipped inthe Cloudflare dashboard, otherwise the beacon is dead on arrival. A
develop->mainpromotion PR follows.Test plan
npm run buildinsite/— passes, anddist/_headerscarries the newpolicy verbatim (Cloudflare
_headerssupports#comments).curl -sI https://codeindex.app | grep -i content-securityshowsthe two new hosts, and the browser console reports no CSP violation.
🤖 Generated with Claude Code