Making the errors go away

Updated on: September 10, 2025

Word count: 681

My webdev-fu is weak because I do not always find the technology very interesting, and I have tried to avoid jobs where that is the main focus, so there are a lot of skills, and knowledge, I’ve never picked up.

On the other hand, I am somewhat obsessive, and have this website. I have been very irritated by various things that are arguably OCD related - let’s be charitable and call it ‘perfectionism’.

For instance: Mozilla’s HTTP Observatory gave my site less than the best security rating - shock! horror! This clearly reflects badly on my basic value as a person and must be remedied! What if the elite hackerz pwn my static site that gets no traffic?

My browser console also reported various errors and warnings, mostly related to Cloudflare and Google Analytics related scripts not being able to run… outrageous! My website is broken and inferior! I must fix it before I can post any writing!

As if that wasn’t enough, for some reason certain RSS feed readers don’t like or can’t parse my RSS feed, which is DEFINITELY VALID XML AND NOT A WEB PAGE OR FORBIDDEN, DON’T LIE TO ME RSSBOARD.ORG!!

I thankfully managed to assuage the fires of hell satisfy my OCD through perseverance.

To improve my Observatory score I used a Cloudflare worker to inject a bunch of security headers, including a strict-ish Content Security Policy I generated by the time-honored tradition of fiddling with the values until things looked okay-ish and stuff worked. Of course most of the headers are pointless, since my site is static, so there’s no backend processing; the site is just a bunch of files on a server that acts likes a hard drive your browser can access. But now someone can’t steal the data that users can’t input anyway, execute man-in-middle attacks, or various other bad things that aren’t relevant. And since I now have A+ rating on Mozilla Observatory, I am clearly a good person!

Despite my best efforts, and days of googling and consulting chatgpt, I could find no solution to the errors related to the Cloudflare analytics (which btw do not seem very reliable, why do I even have it enabled?). In theory my CSP should allow the Cloudflare stuff to run and report back home, but for whatever reason it didn’t. I had resigned myself to the Pyrrhic victory of disabling Cloudflare analytics to make the errors go away; but as I was about to turn it off in Cloudflare I saw an option to add a js snippet instead of having Cloudflare inject it. That didn’t work either, because of my fancy CSP, so I pulled the script file, and added its sha256 hash to the script-src directive. This worked, so I can now get completely inaccurate and unhelpful metrics with which I could do nothing even if they were accurate! No problem, I love jumping through hoops for imaginary points, thanks Calvinism!

What’s this? More console errors indicating stuff that isn’t running? Oh it’s more stuff Cloudflare is injecting, this time creating an iframe and loading their anti-bot script /cdn-cgi/challenge-platform/scripts/jsd/main.js in it. So this has silently been failing, and Cloudflare hasn’t noticed or informed me! Great! I guess that might explain why Cloudflare analytics reports thousands of requests but only single digit visitors in a day… unless it’s for some completely unrelated reason I also don’t have insight into, thanks modern web technologies!

Ah actually now that I think about it maybe that’s why some RSS feed readers can’t read my feed! So let’s turn the bot fight mode off for my feed, that should be easy… oh actually never mind you can’t turn the anti-bot stuff off selectively anymore, you need a paid plan so you can create WAF rules! OK I’LL JUST TURN THE ANTI-BOT STUFF OFF EVERYWHERE THEN, NO PROBLEM, I LOVE BOTS!!

Anyway, Firefox no longer logs any errors, I get 110/100 on Observatory, close to a perfect score on pagespeed.web.dev for desktop, and GTMetrix likewise confirms my inherent goodness - surely the kingdom of heaven is close now.