Cloudflare Web Analytics vs Google Analytics

If Cloudflare shows far more visitors than GA4, you're probably reading its edge numbers. Those count every IP address that sent a request, bots included. Web Analytics, the JavaScript beacon, counts page views from browsers and lands much closer to GA4.

Web Analytics can't replace GA4 if you run campaigns or sell. It has no UTM tracking, no custom events and no goals. Data older than 7 days is sampled to about 10%, and it's kept 6 months.

Notice the Bots row. The edge view counts every bot, Web Analytics only the ones that run JavaScript, and AI Crawl Control nothing but AI crawlers.

Edge traffic analytics sits on your domain's traffic page. On the free plan it shows requests, bandwidth and unique visitors, and Cloudflare says those include crawlers and threats as well as people (Cloudflare). A distinct IP address counts as a visit, and a bot or plugin pulling part of a page counts as a unique visitor. Cloudflare's own FAQ says its visitor numbers are probably higher than other tools' (Cloudflare). Ad blockers can't hide anything from it (FAQ).

Web Analytics is the product this page compares. A small script, beacon.min.js, runs in the browser and reports page views, the referrer, load times and Core Web Vitals (Cloudflare). A "visit" is a page view whose referrer is another site or empty, and there's no unique-visitor metric (Cloudflare).

AI Crawl Control, called AI Audit until August 2025 (Cloudflare), shows which AI crawlers fetch your pages and lets you allow or block each one (Cloudflare). It needs the proxy. There's more on it under bots.

Our read: most "Cloudflare vs GA4" arguments are really the edge view against GA4. That's the door counter against the sign-in book, and they were never going to match.

Some comparisons say Cloudflare's analytics needs no script. That's the edge view. Web Analytics is a script, and it's the one ad blockers stop.

Notice the UTM and events rows. If you run campaigns or sell, those two lines decide it.

We installed each tool alone on a test page and opened it in Chrome four ways: as a person who moves the mouse and scrolls, and as three kinds of bot. One announces it's automated. One hides that. One clicks without moving the mouse, the way AI agents click. No data reached Cloudflare or Google: apart from fetching each script, our lab answered every request itself.

Notice the bot rows. Cloudflare's beacon set out to send a page view for all four visitors, with 2 requests each. A 2022 entry in its changelog says the beacon reports navigator.webdriver. But the beacon served on 13 October 2026 (version 2026.10.0) no longer reads it, and its reports looked the same for all four visitors apart from the browser details.

Headless Chrome as shipped still named itself in its user agent; Cloudflare doesn't say what its Exclude Bots filter uses. GA4 sent all four. Nora labelled the headless browser a bot and the agent-style click an AI agent, and counted the disguised browser that never touched the page as a person, as every tool did.

Weight. Cloudflare's beacon was 10.2 KB compressed. GA4's tag, at 154 KB, was about 15 times as heavy, and Nora's script was 2.7 KB. The beacon is bigger than a plain page counter because it also measures load times and Core Web Vitals.

What stays in the browser. Nothing, for Cloudflare and Nora: no cookies, no storage. That matches what Cloudflare documents (Cloudflare). GA4 left _ga and _ga_<property> for 400 days, Chrome's limit.

Ad blockers. EasyPrivacy blocks the beacon by its file name, /beacon.min.js, and its reports by the path /cdn-cgi/rum, whichever domain serves them. It blocks GA4's tag too. Nora isn't on it.

Our read: treat the beacon as a page counter for browsers, not a count of people. In our lab it reported a person and three automated browsers the same way.

It's the most common question we found about Cloudflare's numbers. The gap can be enormous: in one published test on a single site, Cloudflare's edge view counted about fifteen times the visitors a script-based tool did.

If your new site shows 100,000 page views in Cloudflare and almost nothing anywhere else, go through these in order.

1. Which view are you reading? The edge view counts IP addresses and includes crawlers and threats (Cloudflare). Compare GA4 with Web Analytics, never with the edge view.
2. Bots in the beacon. Bots that run JavaScript send the beacon too. Exclude Bots is a filter you apply in the dashboard (Cloudflare). GA4 removes known bots on its own and never says how many.
3. What a visit is. Cloudflare counts a visit each time someone arrives from another site or from nowhere (Cloudflare). Someone who comes from Google three times in a day is three Cloudflare visits and one GA4 user.
4. Consent. GA4 needs consent in the EEA, the UK and Switzerland (Google); Cloudflare's beacon sets no cookies. This one can run the other way. On the free plan's default setup, Cloudflare doesn't measure visitors in those countries at all (Cloudflare), so a European audience can look smaller in Cloudflare than in GA4.
5. Sampling. After 7 days, Cloudflare's figures are estimates from about 10% of the data (FAQ). GA4's standard reports aren't sampled; its explorations are, above 10 million events (Google).

The measured comparisons are from 2020

The articles with real numbers that rank today are all from 2020. Brian Li ran Web Analytics beside Google Analytics for a few days and saw 14.23% more sessions and 5.3% more page views in Cloudflare (Brian Li). Marko Saric compared Cloudflare's edge analytics with Plausible: 24.7k visitors against 1.6k (Saric). Birchtree found Cloudflare counting about 15 times his real traffic, bots included (Birchtree).

All three came out before GA4 replaced Universal Analytics in July 2023, and before the beacon began reporting automated browsers in October 2022 (Cloudflare). Our lab ran on 13 October 2026. We didn't count one live site for a month. We measured what each script does for a person and for three automated browsers, which is where most of the gaps above begin. On the first site running Nora, 3.3% of the page views its script saw over nine days in October 2026 were bots or AI agents.

Web Analytics only hears from browsers that run its script. Crawlers that fetch the page and never run JavaScript send no beacon, so they're missing from Web Analytics and present in the edge view. For bots that do run scripts, Exclude Bots removes the ones Cloudflare detects; it doesn't say how (Cloudflare). Web Analytics has no AI assistant channel, so a visit from ChatGPT shows under its referrer like any other site.

AI Crawl Control is on every plan. On the free plan your domain must be proxied, crawlers are detected by user agent, and the metrics cover the past 24 hours (Cloudflare). Referral counts are for paid plans only (Cloudflare). It tracks robots.txt compliance, and charging crawlers per fetch is in private beta (Cloudflare). Cloudflare's separate Bot Analytics is for Business and Enterprise plans (Cloudflare).

How much AI crawlers take. Cloudflare's own data for July 2025 put Anthropic's crawlers at about 38,066 fetches for every visit sent back, OpenAI's at about 1,091, Perplexity's at about 195, Microsoft's at about 41 and Google's at about 5 (Cloudflare). The visits that assistants do send are the ones GA4's AI Assistant channel, added on 13 May 2026, groups by referrer (Google).

Other ways to see crawlers. Microsoft Clarity's Bot Activity can read Cloudflare's logs, free plans included since May 2026 (Microsoft).

Nora keeps every page view its script sees and labels it person, AI agent or bot, with the test that caught it: a signature check, the name it gives, how it behaves, machine signs. Like the beacon, it can't see crawlers that never run scripts. That takes server or CDN logs, which Nora doesn't connect yet.

Notice that every price is $0, and look at the last row: Cloudflare counts page views, GA4 events and Nora visitors.

Web Analytics is free on every Cloudflare plan (Cloudflare), and Cloudflare states no page-view cap. The limits are in what it keeps and where it runs:

• Sampling. Raw data is kept 7 days, then reduced to about 10%; queries sample between 0.0001% and 100% (FAQ).
• History. It goes back 6 months (FAQ).
• Sites off the proxy. 10 per account, a soft limit support can raise; proxied sites have no limit (limits).
• Rules for where the beacon goes. None on Free, 5 on Pro, 20 on Business, 100 on Enterprise, proxied sites only (limits).
• The API. GraphQL allows 300 queries per 5 minutes per user (Cloudflare).

Paying for Cloudflare mostly changes the edge view and the rules. Pro ($25 a month billed monthly, $20 a month billed yearly) and Business ($250, or $200 yearly) add page views, visits and a breakdown by URL, counted from every request (plans, zone analytics, FAQ).

GA4 is free with no monthly event cap; its paid edition, GA4 360, is sold through Google's sales team. Nora is free up to 1 million visitors a month.

Where GA4 is ahead

• Campaigns. Every standard UTM tag, so paid, email and social links are told apart (Google).
• Events and revenue. Custom events with up to 25 parameters, key events, and revenue from purchases (Google).
• Google Ads conversions and audiences (Google).
• Realtime. A view of the last 30 minutes. Cloudflare documents no live view; its default range is the past 24 hours (Cloudflare).
• People across days, Search Console reports (Google) and a free daily export to BigQuery (Google).

Where Cloudflare is ahead

• Nothing stored. No cookies, nothing in the browser, and IP addresses dropped at the nearest data centre (Cloudflare).
• A light beacon. GA4's tag was about 15 times as heavy in our lab.
• Page speed. Core Web Vitals, and how each page loaded, including prerender and the back-forward cache (Cloudflare).
• Nothing to install on a free-plan domain, and a weekly email summary on every plan (Cloudflare).
• Nothing held back. GA4 hides small rows behind thresholds (Google) and can take 24 to 48 hours to process (Google); Cloudflare documents neither.

Features from each maker's pages on 13 October 2026.

Since 15 October 2025, Cloudflare has turned Web Analytics on for free-plan domains. Pro, Business and Enterprise sites switch it on themselves (Cloudflare). In the default setup, visitors who reach Cloudflare data centres in the EEA, Switzerland and the UK aren't measured (Cloudflare). Some owners found out by surprise; one Hacker News thread about it in August 2026 drew 202 comments (Hacker News).

• To check: look in your page source for beacon.min.js from static.cloudflareinsights.com.
• To turn it off: open Web Analytics for the site and choose Disable under Manage RUM Settings, or delete the site under Advanced Options. Cloudflare won't switch it back on (Cloudflare).
• To include European visitors: change the setting in the dashboard (Cloudflare). Proxied sites set up by hand can choose to leave them out (Cloudflare).

What it collects. Page load timings, Core Web Vitals, the referrer and the page address. No cookies, no browser storage, and no fingerprinting by IP or user agent (Cloudflare). Data is processed at the nearest Cloudflare data centre, which may be in another country (Cloudflare).

Web Analytics doesn't work with Customer Metadata Boundary, Cloudflare's option for keeping analytics data in the EU (Cloudflare); its datasets return data only when that boundary is set to the US (Cloudflare). Cloudflare makes no statement about cookie banners.

We read reviews and threads from the past two years. The same few things come up again and again. Here they are, in our words, with links to where people said them.

Notice that most rows need a second tool, or a setting you have to change.

Of the three, Nora is the closest to Cloudflare Web Analytics: free, no cookies, a small script. It adds a live view of the last 30 minutes, goal pages, AI assistants grouped as a source, a weekly email, CSV export, report links, and a label on every page view saying whether it was a person, an AI agent or a bot. It's free up to 1 million visitors a month and weighs 2.7 KB.

Cloudflare is the better pick in several cases. Pick it if you want Core Web Vitals and load times beside your page counts. Its edge view and AI Crawl Control see crawlers that never run scripts; Nora can't until server or CDN logs are connected. And it's already on if your domain is on the free plan. Nora is hosted in the US, is closed source, can't import GA history, and launches on 1 November 2026, so it has no track record yet.

Nora Lab, the research team at Nora Analytics, ran every test on this page the same way for each tool. Here is exactly how, so you can judge the results yourself.

The full method, with what each visitor stands for, is on How we test. Every result from the lab run is public as JSON.