How to track visitors on Cloudflare.
The option for sites you cannot edit. A Worker rewrites the HTML as it passes through Cloudflare, so nothing on the origin changes at all.
What you need
- • The domain proxied through Cloudflare — orange cloud, not DNS-only.
- • A Cloudflare account able to deploy Workers.
- • Node and npx available locally.
- • A VisitorPing site key, in the form vp_ABC23456 — the prefix vp_ and eight characters. The alphabet leaves out I, O, 0 and 1, so there is nothing to misread when copying it.
Install it
- 1
Set your site key
Put your key in wrangler.jsonc as VISITORPING_SITE_KEY, or add it as a Worker secret if you would rather not commit it.
- 2
Deploy the Worker
From the worker directory.
npx wrangler deploy - 3
Route your traffic through it
In the Cloudflare dashboard add a Worker Route such as *yourdomain.com/* mapped to the Worker.
- 4
Check the live site
Load the site in a private window and view the source. The tag should appear in the head even though nothing on your origin changed.
When this is the right answer
Use it when the platform gives you no way to add a script — a closed website builder, a site you do not have logins for, or one where custom code sits behind a plan upgrade you would rather not buy.
It is also the tidiest option for an agency running many client sites on the same Cloudflare account.
Check the SSL mode first
If your host issues its own certificate for the domain, putting Cloudflare's proxy in front of it needs the right SSL mode or the site will error for every visitor. Confirm that on a staging domain before pointing production through it.
What you will actually see
Per visit: the city and region the network resolves to, where the visitor came from, the page they landed on, their device and browser, and whether they have been before.
You do not get a name, an email address, or an identity. Nobody can give you that from a page view, whatever the marketing says. Geolocation resolves a network rather than a doorstep, so a visitor on a VPN or a mobile network can appear in the wrong city entirely. Treat location as a hint.
You are collecting visitor data, so say so in your privacy notice and check which consent rules apply where your customers are — a question for your own legal advice, not for a setup guide.
If it is not working
- The site returns an SSL error after enabling the proxy
- The SSL mode does not match how your origin serves HTTPS. Full (Strict) is usually correct when the origin has a valid certificate.
- The Worker is deployed but the tag is missing
- No route is bound to it, or the route pattern does not match the paths visitors use. A Worker with no route runs for nothing.
Find what is costing you search clicks, then watch the fix work.
VisitorPing reads your own Search Console data for the pages losing clicks, then rings your phone the moment someone lands on your website.