Track Cloudflare analytics

What you need

• A Cloudflare account that can see the account and zone you want.
• For Web analytics: the site added to Cloudflare Web Analytics. In the Cloudflare dashboard go to Web Analytics, then Add a site. Cloudflare's steps: https://developers.cloudflare.com/web-analytics/get-started/
• For HTTP zone traffic: a domain (zone) on Cloudflare.

Connect

1. Open Configure, Sources tab. In the top row, pick Cloudflare.
2. Under Track, check Web analytics (RUM / CWV), HTTP zone traffic, or both.
3. Click Connect Cloudflare. Cloudflare opens.
4. Choose the Cloudflare account(s) we may read, review the permissions, and select Authorize. Leave all permissions on; without them the account and site lists come back empty.
5. You land back on the same row. Account, Site and Zone unlock and fill with lists from your account. Pick an Account and Site for Web analytics, and a Zone for HTTP traffic.
6. Click Confirm (the check mark).

Another site or zone? Add another Cloudflare row. It reuses your Connect.

What happens next

Once a day we read yesterday's numbers (UTC) and show them on your dashboards:

• Web analytics: 75th-percentile LCP, CLS and INP for the site.
• HTTP zone traffic: requests, page views, threats and bytes for the zone.

Common problems

• "Connect Cloudflare first.": click Connect Cloudflare before Confirm.
• "No accounts returned — grant may lack Account Settings Read, or reconnect.": click Reconnect Cloudflare, select the account, and leave every permission on.
• The account you want isn't offered on Cloudflare's screen: an admin of that account has turned off public OAuth app access (Manage Account, Members, Settings). Ask them. Details: https://developers.cloudflare.com/fundamentals/oauth/authorizing-an-application/
• The Site list is empty: that account has no Web Analytics site yet. Add one in Cloudflare first.
• Blank numbers: no traffic yesterday, or Web Analytics only just started collecting.
• "Reconnect this integration. The refresh token was rejected.": click Reconnect Cloudflare on the row.

(TODO: dogfood the post-Connect Account / Site / Zone lists on a real account and update these steps.)

What we can and can't watch

• Can: the daily numbers above, one site and/or one zone per row.
• Can't: per-page, per-country or real-time breakdowns, logs, Workers, or firewall events. We can't change any Cloudflare setting.

Privacy

• You grant read-only Cloudflare permissions: Account Analytics Read, Analytics Read, Account Settings Read (to list your sites) and Zone Read (to list your zones). They only apply to the accounts you pick on Cloudflare's screen.
• We store the access encrypted. It is never sent to an AI model.
• To stop: remove the row in Configure (the minus button). Removing your last Cloudflare row deletes our stored access. To revoke at Cloudflare too, go to your Profile, Access Management, Connected Applications, and select Revoke for Droppin' Eaves.