Cloudflare Web Analytics

Cloudflare Web Analytics is a free, cookieless measurement beacon: a small JavaScript snippet that reports pageviews, visits, referrers, paths, countries, device types, and real-user Core Web Vitals. Cloudflare states it uses no client-side state — no cookies, no localStorage — and does not fingerprint visitors via IP address or User-Agent, so there is no cross-session visitor tracking at all, by design.

The data model follows from that. A page view is a successful HTTP response with an HTML content-type; a visit is a page view whose HTTP referrer doesn’t match your hostname. That means “visits” measure arrivals, not people: there are no unique-visitor counts, and a user who opens several tabs from an external link counts as several visits. If you’re migrating from a visitor-based tool, expect the headline numbers to mean something different, not just differ.

Implementation is either manual or automatic. For any site, you paste the snippet before the closing body tag. For sites proxied through Cloudflare, the snippet can be auto-injected at the edge — with two documented caveats: auto-injection is skipped for visitors from the EU, and it won’t work on responses with a Cache-Control: public, no-transform header. Cloudflare Pages projects can enable it from the Metrics section, with the snippet added on the next deployment. Single-page apps are supported: each route change sends the measurement for the route being left, though metrics for the final route can be lost if the browser closes first.

Gotchas worth knowing before you commit to it as your only signal. The beacon is on common blocklists — Cloudflare’s own FAQ names AdBlock Plus, Brave, and the DuckDuckGo extension — so counts undercount technical audiences; the separate edge-side HTTP traffic analytics (for proxied sites) can’t be blocked, but measures requests, not pages. Retention is tiered: unsampled beacon data is kept for 7 days, then aggregated down to roughly 10%, with about six months of history in the dashboard. There is no raw export and no custom events (“not yet,” per the FAQ). Rules for scoping what gets tracked are plan-gated on proxied sites: none on Free, 5 on Pro, 20 on Business, 100 on Enterprise.

Use it when you need a zero-cost, zero-consent-surface baseline for traffic and Core Web Vitals, or a sanity check alongside a primary analytics tool. Look past it when you need unique visitors, conversion measurement, campaign analysis, custom events, or data you can query and keep.