Cloudflare is injecting JavaScript into XML feed

[Aymen007]

What is the name of the domain?

.com

What is the issue you’re encountering

Cloudflare is injecting JavaScript into XML feed

What are the steps to reproduce the issue?

Hello Cloudflare community,

I have been using Cloudflare for my online store for several years, and until recently everything was working correctly.

My website is an e-commerce store, and I use two PrestaShop modules to export my products to external platforms:

• Google Merchant Center feed module
• Facebook Dynamic Ads / Catalog feed module

These modules generate XML product feeds that are used by Google Merchant and Facebook Catalog to synchronize my products.

A few days ago, both Google Merchant and Facebook started showing an authentication problem when trying to access the XML feed:

• Unauthorized error
• Username/password required

After investigation, I created Cloudflare Custom Rules to allow access to these feed URLs:

Google feed:
/module/gmerchantcenterpro/fly

Facebook feed:
/module/facebookproductad/fly

The authentication problem was solved after creating the Skip rules, and Google/Facebook could access the feeds again.

However, a new problem appeared.

Now Google Merchant and Facebook reject the XML files because the XML response is modified and contains additional content that should not be there.

At the end of the XML file, after the closing tag:

</rss>

I can see Cloudflare-injected code:

</rss><script>(function(){function c(){var b=a.contentDocument||(a.contentWindow&&a.contentWindow.document);if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={...}";var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);</script>

This makes the XML feed invalid for Google Merchant and Facebook Catalog.

Facebook also reports:

Data file failed to upload

An XML declaration was found on line 1 column 2 but it must appear at the very start of the document. Please move the XML declaration to the first line of the file.

I would like to understand which Cloudflare feature or setting is injecting this script into the XML response.

Things I already tested:

• Disabled Bot Fight Mode temporarily
• Disabled JS detections
• Disabled RUM / Web Analytics injection
• Checked Browser Integrity Check
• Created Skip rules for the feed URLs
• Allowed the feed paths through Cloudflare security rules

Despite these tests, the extra Cloudflare script is still added to the XML output.

Could someone please help me identify:

1. Which Cloudflare feature adds /cdn-cgi/challenge-platform/scripts/jsd/main.js or the Cloudflare beacon script into responses?
2. Which setting should be disabled or modified to prevent any JavaScript injection into XML feeds?
3. Is there a recommended Cloudflare configuration for XML product feeds used by Google Merchant Center and Facebook Catalog?

My goal is simply to keep the XML feed generated by the modules completely unchanged, for example:

<?xml version="1.0" encoding="UTF-8"?>
<rss>
...
</rss>

without any additional scripts before or after the XML content.

Thank you very much for your help and guidance.

Best regards,

[GeorgeAppiah]

The JS means the request is still being challenged.

You mentioned

@Aymen007

• Disabled Bot Fight Mode temporarily

Were you seeing the challenge script injection with BFM disabled completely? I ask because BFM cannot be skipped at all, so if it was enabled, your “skip” rule would not be able to skip it.

In any case… take a look at the zone’s Security Events for details of whatever is challenging the request: https://dash.cloudflare.com/?to=/:account/security-center/events

Good luck!

[Aymen007]

Hello,

Thank you for your previous reply.

I followed your advice and checked the Security Events and different Cloudflare settings.

Here is what I found after testing.

My issue is still the same: Cloudflare is modifying my XML product feed responses by adding this code at the end of the XML file:

</rss><script>
(function(){... 
window.__CF$cv$params={...};
...
a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';
...
</script>

This makes the XML invalid for Google Merchant Center and Facebook Catalog.

I performed several tests:

1. Custom Rules

I already created Skip rules:

Google feed:

URI Path contains /module/gmerchantcenterpro/fly

Action:

Skip

Facebook feed:

URI Path contains /module/facebookproductad/fly

Action:

Skip

In Security Events, when I test the Google feed URL, the event shows:

Service: Custom rules
Action taken: Skip
Rule: Allow Google Merchant Feed

Example:

Path:
/module/gmerchantcenterpro/fly

Action:
Skip

So the Custom Rule is working correctly.

2. Web Analytics / RUM

I found that Cloudflare Web Analytics was enabled:

Real User Measurements (RUM)
Enable
The JS Snippet will be automatically injected.

I disabled RUM and purged the Cloudflare cache.

After this change, the following script disappeared from the XML:

https://static.cloudflareinsights.com/beacon.min.js

So Web Analytics injection was one issue, and this part is now solved.

However, the Challenge Platform script is still injected:

/cdn-cgi/challenge-platform/scripts/jsd/main.js

3. Bot Fight Mode

I checked:

Security → Settings → Bot traffic

Bot Fight Mode was ON.

I disabled it completely and tested again.

The Challenge Platform script was still added to the XML.

4. Browser Integrity Check

I checked:

Browser Integrity Check

It was ON.

I disabled it temporarily and tested again.

The script was still injected.

5. Under Attack Mode

Checked:

I'm Under Attack Mode

Result:

Disabled

6. Managed Rules / WAF

I checked my Security Rules.

I have:

• Custom Rules: 5/5

• Rate Limiting Rules: none

• Managed Rules: no managed rules created

The only active rules are my own custom rules.

7. Security Events

For the feed request, Security Events only shows:

Action taken: Skip
Service: Custom rules
Rule: Allow Google Merchant Feed

I do not see any event showing:

• Managed Challenge

• JS Challenge

• Bot Fight Mode

• Browser Integrity Check

• WAF Managed Rules

But the XML response is still modified with:

window.__CF$cv$params
/cdn-cgi/challenge-platform/scripts/jsd/main.js

At this point, I believe the remaining injection is coming from another Cloudflare Challenge mechanism that is not appearing in Security Events.

Could you please help me identify which Cloudflare feature is adding:

/cdn-cgi/challenge-platform/scripts/jsd/main.js

and how I can completely bypass challenges for these XML feed URLs?

The goal is to keep these responses untouched:

<?xml version="1.0" encoding="UTF-8"?>
<rss>
...
</rss>

without any JavaScript injection.

Thank you for your help.

[Laudian]

@Aymen007

However, the Challenge Platform script is still injected:

/cdn-cgi/challenge-platform/scripts/jsd/main.js

Please have a look at this:

Disable JS Detections

This tutorial explains how to disable JS Detections, which can currently only be done via the API to my knowledge. This is necessary because enabling Bot Fight Mode (BFM) also enables JS Detections (JSD), but disabling BFM does not disable JSD. This is after disabling BFM, but JSD are still active: [image] With JSD enabled, Cloudflare injects a script at the end of of the site’s HTML. </table> <script>(function() ... </script> </body></html> Since the question of how to remove it comes up…

[Aymen007]

Hello Cloudflare community,

I would like to provide an update regarding my XML feed issue.

After investigation, we found that the problem was caused by JS Detections.

The XML feeds for Google Merchant Center and Facebook Catalog were being modified by Cloudflare with the injected script:

/cdn-cgi/challenge-platform/scripts/jsd/main.js

This was making the XML invalid because the script was added after the closing XML tag.

Following the advice from the community, I used the Cloudflare API and changed:

enable_js: false
fight_mode: false

After this change, the XML feeds are now clean and valid:

</channel>
</rss>

and Google Merchant / Facebook feeds are working correctly.

However, I have an important question regarding the security configuration.

The API change disabled JS Detections globally for the entire zone, not only for the XML feed URLs.

My goal is to keep my website fully protected with Cloudflare security features:

• Bot Fight Mode enabled

• JS Detections enabled

• Browser Integrity Check enabled

• Web Analytics / RUM enabled

but exclude only these two XML feed URLs:

/module/gmerchantcenterpro/fly
/module/facebookproductad/fly

because these URLs are only used by Google Merchant Center and Facebook Catalog to retrieve product feeds and must return a pure XML response without any JavaScript injection.

Is there a recommended Cloudflare configuration, API command, Configuration Rule, or another method to disable JS Detections only for these specific paths while keeping it enabled for the rest of the website?

In other words, I would like to apply this exception only to the product feed URLs, not to the entire domain.

I have one additional question to better understand the impact of each Cloudflare feature.

During my troubleshooting, I temporarily disabled several options:

• Bot Fight Mode
• JS Detections
• Browser Integrity Check
• Web Analytics / RUM

I confirmed that disabling JS Detections removed the injected script:

/cdn-cgi/challenge-platform/scripts/jsd/main.js

from my XML feeds.

My question is:

Are all these features responsible for modifying the XML response, or was the XML injection only caused by JS Detections (and possibly RUM for the analytics beacon)?

In other words, are there some Cloudflare security features that I can safely re-enable without affecting my Google Merchant and Facebook Catalog XML feeds?

I would like to keep my website protected as much as possible, but avoid only the features that can modify the XML output.

Could you please confirm which of these options can inject content into responses and which ones only perform security checks without changing the XML response?

Thank you for your help.

[Aymen007]

Hi,

I just wanted to follow up regarding my previous message, as I have not yet received a reply.

Could you please let me know whether I should now re-enable any of the Cloudflare options that we disabled during the troubleshooting process?

At the moment, Bot Fight Mode, JS Detections, Browser Integrity Check, and Web Analytics / RUM are still disabled.

Since the XML feeds are now working correctly, I would like to know if I can safely re-enable any of these features while keeping the Google Merchant and Facebook XML feeds working properly, or if they should remain disabled.

Could you please advise which options should stay disabled and which ones can be enabled again?

Thank you in advance for your help.

Best regards,

[Aymen007]

I have another observation that may be related to the changes we made.

Before disabling Bot Fight Mode, JS Detections, Browser Integrity Check, and Web Analytics / RUM, my Cloudflare dashboard usually showed around 4,000 to 10,000 unique visitors per 24 hours.

After making these changes (starting around July 25), the numbers increased dramatically. Today my dashboard shows approximately:

• Unique Visitors (24h): 95.14k

• Unique Visitors (7 days): 1.04M

• Unique Visitors (30 days): 1.78M

Google Merchant and Facebook feeds are now working correctly, and the XML files are clean.

However, I am concerned that disabling these protections may also have allowed significantly more bot traffic to reach my website.

My question is:

Which of these features is actually responsible for the XML script injection?

• Bot Fight Mode

• JS Detections

• Browser Integrity Check

• Web Analytics / RUM

Are all of them related to the XML issue?

Ideally, I would like to keep my website protected while keeping the Google Merchant and Facebook XML feeds working correctly.

Which features can I safely enable again without breaking the XML feeds?

Thank you for your advice.

[Laudian]

@Aymen007

Ideally, I would like to keep my website protected while keeping the Google Merchant and Facebook XML feeds working correctly.

Hi, sorry for the late reply.

The Pro plan has Super Bot Fight Mode, which does not automatically inject any JS, unlike the free Bot Fight Mode.

[Aymen007]

Hi,

Thank you for your reply.

I am currently using the Cloudflare Free plan, so I do not have access to Super Bot Fight Mode.

I would like to confirm if I understood correctly:

The XML injection problem is only caused by JS Detections, correct?

Meaning that the other options, such as:

• Browser Integrity Check

• Web Analytics / RUM

• other security features

can be enabled again without affecting the XML feeds, and the Google Merchant and Facebook XML files should remain clean?

Also, I have one question regarding the API command.

I disabled JS Detections and Bot Fight Mode using the Cloudflare API from the terminal.

If I now enable Bot Fight Mode again from the Cloudflare dashboard:

• Will JS Detections remain OFF because it was disabled through the API?

• Or will enabling Bot Fight Mode automatically turn JS Detections back ON?

If Bot Fight Mode requires JS Detections to be enabled, is it possible to keep:

• Bot Fight Mode = ON

• JS Detections = OFF

by sending another API command only to disable JS Detections?

In other words, can Bot Fight Mode continue working normally while JS Detections stays disabled?

I want to keep the website protected against bots while ensuring that Google Merchant and Facebook XML feeds remain clean.

Thank you for your help.

[Laudian]

@Aymen007

• Or will enabling Bot Fight Mode automatically turn JS Detections back ON?

This.

@Aymen007

If Bot Fight Mode requires JS Detections to be enabled, is it possible to keep:

• Bot Fight Mode = ON

• JS Detections = OFF

by sending another API command only to disable JS Detections?

No.

@Aymen007

Meaning that the other options, such as:

• Browser Integrity Check

• Web Analytics / RUM

I would assume these also inject JS, but I don’t know. You could just try it very quickly.

[Aymen007]

Hi,

Thank you for your reply.

Could you please confirm if it is possible to create a Cloudflare rule (for example a Skip rule / Custom Rule) that applies only to these XML feed URLs and prevents JavaScript injection while keeping the security features active for the rest of the website?

For example, excluding only:

• Google Merchant feed URL:
  /module/gmerchantcenterpro/cron...

• Facebook feed URL:
  /facebookproductad....xml

My goal is:

• Keep Bot Fight Mode enabled;

• Keep JS Detections enabled for normal website pages;

• Keep the other Cloudflare protections active;

• But ensure that the XML feeds are not modified by Cloudflare and remain clean for Google Merchant and Facebook.

Is this possible with Cloudflare Free plan?

If yes, which rule/action should be configured exactly?

Thank you for your advice.

[Laudian]

The answer is still no. Bot Fight Mode and JSD are all or nothing.