diff options
| author | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
| commit | 7d1ef624fd8842acab54fce6373b4ad2bbb25eb9 (patch) | |
| tree | 52f3eb670a8fb6246de982b219d10a0346526736 | |
| parent | e13d8e3d85fed0d8b8421c624dac2e69e3398cab (diff) | |
| download | website-ops/cloudflare-analytics.tar.gz | |
Describe the Web Analytics exception in the architecture and runbookops/cloudflare-analytics
The four hosts of the site now allow Cloudflare's Web Analytics beacon,
but ARCHITECTURE.md and OPERATIONS.md still said the policy blocks every
script an intermediary adds. Both now name the beacon, where it loads
from and where it reports, and keep the forum placeholder's same-origin
policy apart.
| -rw-r--r-- | Documents/ARCHITECTURE.md | 6 | ||||
| -rw-r--r-- | Documents/OPERATIONS.md | 12 |
2 files changed, 12 insertions, 6 deletions
diff --git a/Documents/ARCHITECTURE.md b/Documents/ARCHITECTURE.md index 53a32ac..40d72eb 100644 --- a/Documents/ARCHITECTURE.md +++ b/Documents/ARCHITECTURE.md @@ -105,5 +105,7 @@ allows only its own script, stylesheet and two images. ## Security headers Nginx sends a content security policy that allows only same-origin resources, plus HSTS, `X-Content-Type-Options`, -`X-Frame-Options: DENY` and a referrer policy. The policy has no exception for third-party scripts; a script injected -by an intermediary, such as an analytics beacon added by a CDN, is blocked by the browser. +`X-Frame-Options: DENY` and a referrer policy. The policy of the four hosts of the site has one exception: Cloudflare +Web Analytics, which Cloudflare adds to every page. Its beacon loads from `https://static.cloudflareinsights.com` and +reports to `https://cloudflareinsights.com` and to `/cdn-cgi/rum` on the same host. Any other script injected by an +intermediary is blocked by the browser. The forum placeholder keeps a policy of its own, same-origin only. diff --git a/Documents/OPERATIONS.md b/Documents/OPERATIONS.md index ce1a4ee..cf4db71 100644 --- a/Documents/OPERATIONS.md +++ b/Documents/OPERATIONS.md @@ -250,10 +250,14 @@ static files and 404 for other paths. Expected legacy redirect responses are 308. In maintenance mode the main domain answers 503 with `Retry-After`. A 200 from a retired login or registry route is a regression. -Neither the static site nor the forum placeholder should send personal data -to a third-party analytics service. The content security policy allows -same-origin scripts only, so a script added by an intermediary is blocked by -the browser rather than run. Theme and language preferences are kept +The static site uses Cloudflare Web Analytics, which counts page views without +cookies and without a fingerprint of the visitor. Its content security policy +allows same-origin scripts and that beacon only: the beacon loads from +`https://static.cloudflareinsights.com` and reports to +`https://cloudflareinsights.com` and `/cdn-cgi/rum`. Any other script added by +an intermediary is blocked by the browser rather than run. The forum +placeholder allows same-origin scripts only and sends nothing to an analytics +service. Theme and language preferences are kept locally in the browser. Nginx and API logs still need normal retention and access-control practices, but this repository does not define an account database or a user profile store. |