vendor/cloudflare · vendor documented

Cloudflare Web Analytics beacons put the site token on the query

Cloudflare documents the tag-manager install as beacon.min.js?token=. Automatic injection uses data-cf-beacon instead, so a bare script URL is a warning. spa is true or false when present. /cdn-cgi/rum is not this pack.

GTM cannot read data-cf-beacon

The FAQ install for tag managers puts token on the query. A custom HTML tag that only sets the attribute will not send the site token on the script URL.

Rule: vendor.cloudflare.param.token.missing

What this pack matches

Hosts: static.cloudflareinsights.com
Paths: …beacon.min.js…
Vendor docs: developers.cloudflare.com/web-analytics/faq/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`token`	recommended	It is the Web Analytics site token. Cloudflare documents the GTM install as `beacon.min.js?token=`. Automatic injection sends the same token in `data-cf-beacon`, not the query. Fix: For a tag-manager install, put the site token on the query as `token=`.	`vendor.cloudflare.param.token.missing` `vendor.cloudflare.param.token.empty`	docs
`spa`	optional	Cloudflare documents `spa` on the beacon query for single-page apps. Fix: Send `spa=false` or `spa=true` when you set it.	`vendor.cloudflare.param.spa.empty` `vendor.cloudflare.param.spa.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/cloudflare

Try this failing payload in the playground. Cloudflare Web Analytics beacon missing token.

https://static.cloudflareinsights.com/beacon.min.js

cargo install pixellint · npm install pixellint