diff options
| author | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
| commit | 7d1ef624fd8842acab54fce6373b4ad2bbb25eb9 (patch) | |
| tree | 52f3eb670a8fb6246de982b219d10a0346526736 /Documents/OPERATIONS.md | |
| parent | e13d8e3d85fed0d8b8421c624dac2e69e3398cab (diff) | |
| download | website-ops/cloudflare-analytics.tar.gz | |
Describe the Web Analytics exception in the architecture and runbookops/cloudflare-analytics
The four hosts of the site now allow Cloudflare's Web Analytics beacon,
but ARCHITECTURE.md and OPERATIONS.md still said the policy blocks every
script an intermediary adds. Both now name the beacon, where it loads
from and where it reports, and keep the forum placeholder's same-origin
policy apart.
Diffstat (limited to 'Documents/OPERATIONS.md')
| -rw-r--r-- | Documents/OPERATIONS.md | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/Documents/OPERATIONS.md b/Documents/OPERATIONS.md index ce1a4ee..cf4db71 100644 --- a/Documents/OPERATIONS.md +++ b/Documents/OPERATIONS.md @@ -250,10 +250,14 @@ static files and 404 for other paths. Expected legacy redirect responses are 308. In maintenance mode the main domain answers 503 with `Retry-After`. A 200 from a retired login or registry route is a regression. -Neither the static site nor the forum placeholder should send personal data -to a third-party analytics service. The content security policy allows -same-origin scripts only, so a script added by an intermediary is blocked by -the browser rather than run. Theme and language preferences are kept +The static site uses Cloudflare Web Analytics, which counts page views without +cookies and without a fingerprint of the visitor. Its content security policy +allows same-origin scripts and that beacon only: the beacon loads from +`https://static.cloudflareinsights.com` and reports to +`https://cloudflareinsights.com` and `/cdn-cgi/rum`. Any other script added by +an intermediary is blocked by the browser rather than run. The forum +placeholder allows same-origin scripts only and sends nothing to an analytics +service. Theme and language preferences are kept locally in the browser. Nginx and API logs still need normal retention and access-control practices, but this repository does not define an account database or a user profile store. |