Cloudflare rewrites the privacy email on qn.isnull.dev, so a crawler cannot read it #237

New Issue

Open

opened 2026-09-10 05:18:39 -05:00 by null · 0 comments

null commented

2026-09-10 05:18:39 -05:00

Owner

Found by the live audit after the v0.9.6 deploy, 2026-09-10.

What is true now. On the Cloudflare front door, https://qn.isnull.dev/privacy-policy serves the contact address as Cloudflare's email obfuscation:

<a href="/cdn-cgi/l/email-protection#...">[email&#160;protected]</a>

The real address is only recovered by JavaScript. The token changes on every response, which is why two fetches of that page never match byte for byte.

https://queuenorth.com/privacy-policy is unaffected: it goes through nginx-proxy-manager, not Cloudflare, and serves the address in plain text identically to every agent.

What it costs. Little today, and it is worth knowing rather than assuming. The canonical on that page points at queuenorth.com, and the ad platforms are given queuenorth.com URLs, so what Meta reads is the readable copy. It would matter if anything ever hands out the qn.isnull.dev address of a page, because the crawlers that check a privacy policy do not run JavaScript, which is the entire reason this site is prerendered.

What to do. Decide, do not drift: either turn Email Address Obfuscation off for that zone in Cloudflare, or record here that the second door is deliberately not the one given to ad platforms. scripts/audit-html.js --url now names this precisely rather than reporting it as crawlers being served different pages.

Verify: node scripts/audit-html.js --url https://qn.isnull.dev exits 0, or this issue is closed with the decision that the second door is not used for ad review and the audit is run only against queuenorth.com.

Found by the live audit after the v0.9.6 deploy, 2026-09-10. **What is true now.** On the Cloudflare front door, `https://qn.isnull.dev/privacy-policy` serves the contact address as Cloudflare's email obfuscation: ``` <a href="/cdn-cgi/l/email-protection#...">[email protected]</a> ``` The real address is only recovered by JavaScript. The token changes on every response, which is why two fetches of that page never match byte for byte. `https://queuenorth.com/privacy-policy` is unaffected: it goes through nginx-proxy-manager, not Cloudflare, and serves the address in plain text identically to every agent. **What it costs.** Little today, and it is worth knowing rather than assuming. The canonical on that page points at queuenorth.com, and the ad platforms are given queuenorth.com URLs, so what Meta reads is the readable copy. It would matter if anything ever hands out the qn.isnull.dev address of a page, because the crawlers that check a privacy policy do not run JavaScript, which is the entire reason this site is prerendered. **What to do.** Decide, do not drift: either turn Email Address Obfuscation off for that zone in Cloudflare, or record here that the second door is deliberately not the one given to ad platforms. `scripts/audit-html.js --url` now names this precisely rather than reporting it as crawlers being served different pages. Verify: `node scripts/audit-html.js --url https://qn.isnull.dev` exits 0, or this issue is closed with the decision that the second door is not used for ad review and the audit is run only against queuenorth.com.