cloudflare.com source code

The homepage of cloudflare.com is 1.3 MB of HTML built with HubSpot, Astro, Google Tag Manager. Its security headers get a B. We last checked it on 2026-10-27.

See the full source

The first lines of its HTML

<!DOCTYPE html>
<html lang="en" class="font-stk-bureau-sans">
  <head>
    <script>
      (function(w,i,g){w[g]=w[g]||[];if(typeof w[g].push=='function')w[g].push(i)})
      (window,'GTM-NDGPDFZ','google_tags_first_party');
    </script>
    <script>
      (function(w,d,s,l){w[l]=w[l]||[];(function(){w[l].push(arguments);})('set', 'developer_id.dY2E1Nz', true);
      var f=d.getElementsByTagName(s)[0],
      j=d.createElement(s);j.async=true;j.src='/go9u/';
      f.parentNode.insertBefore(j,f);
      })(window,document,'script','dataLayer');
    </script>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
    <meta name="theme-color" content="#ff4801" media="(max-width: 767px)">
    <link rel="preconnect" href="https://imagedelivery.net" crossorigin>
    <link rel="preconnect" href="https://ot.www.cloudflare.com" crossorigin>
    <link rel="preload" href="/icons.svg" as="image" type="image/svg+xml">
    <link rel="preload" href="/fonts/STKBureauSans-Book.otf" as="font" type="font/otf" crossorigin>
    <link rel="preload" href="/fonts/STKBureauSans-Regular.otf" as="font" type="font/otf" crossorigin>
    <link rel="icon" type="image/x-icon" href="/favicon.ico">
    <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">
    <script>
      (function () {
      var d = document.documentElement;
      d.classList.add('js');
      try {
      var p = new URLSearchParams(window.location.search);

All the code · Meta tags and report · Response headers · What changed