Edge Measurement

Edge Measurement runs a small Cloudflare Worker in front of your storefront so Fond can count visits from answer engines at your own edge, before anything in the browser can interfere. You will find it under Settings → Integrations for the website you connect, and it needs a Premium plan.

It is separate from the Google Analytics connection, and the two never merge. Analytics tells you what visitors did once they arrived. Edge Measurement tells you what arrived at all.

What it adds over Google Analytics

Visits an ad blocker or consent banner would hide. Analytics runs as JavaScript in the visitor's browser, so anything that blocks scripts or waits on a consent choice removes the visit from your reports. The Worker runs on Cloudflare's network, not in the browser, so it sees the request either way.

AI crawlers. GPTBot, ClaudeBot, PerplexityBot and their peers fetch your pages to build the answers that mention you. They run no JavaScript, so Analytics never records them. Edge Measurement records which of your pages they crawl and how often, and the address each crawler came from, so it can check that claim against published vendor ranges. That check is not live yet, and the page says so rather than showing an unverified bot as verified.

Higher-fidelity referral counts. Fond reads the referrer at the edge rather than relying on how Analytics grouped it after the fact.

Where the data appears. The Worker collects and Fond stores and aggregates from the moment you connect. Your crawl and referral data shows on the AI Traffic page for the website: which pages AI crawlers fetched and which bot fetched them, and referrals as your own edge saw them, beside the Google Analytics figures.

Before you install

Cloudflare's free plan allows 100,000 Worker requests per day, counted across your whole Cloudflare account, and every request to your storefront counts. A busy store can exceed this. Check your Cloudflare plan against your traffic before you start.

Cloudflare does not run Workers on /checkout. Shopify excludes it. Orders and revenue therefore keep coming from your Google Analytics connection, not this one.

Your domain must already be on Cloudflare, or be moved onto it. Fond checks which of the two applies before you start and tells you which path you are on. If your domain is already on Cloudflare, setup is a token and a one click install, with no DNS changes.

The certificate hazard, if you are moving DNS to Cloudflare

This is the part worth reading twice, because it fails silently and weeks later.

Your store's TLS certificate renews by answering a challenge at /.well-known/acme-challenge/. If Cloudflare's Always Use HTTPS setting redirects that path, the challenge never gets answered and the certificate simply fails to renew. Nothing breaks on the day you change the setting. Your store goes insecure a month or so afterwards, when the existing certificate expires.

Three settings therefore have to hold while Edge Measurement is connected:

Setting	Required value
Always Use HTTPS	Off
SSL/TLS encryption mode	Full (or Full (strict))
/.well-known/acme-challenge/	Excluded from redirect rules

Fond reads all three before advising any change, stores what they were, and re-checks them on a schedule afterwards. If one drifts back, you get told.

Permissions the API token needs

Create a Custom token on Cloudflare's API Tokens page, with these permissions and, under Zone Resources, Include → Specific zone → your store's domain.

Fond's setup screen lists the exact rows to add, with a copy button on each. Use that list rather than one written down anywhere else, including here: it is rendered from the same definition the server validates your token against, so the instructions and the check cannot disagree. Cloudflare occasionally renames a permission, and a hand-copied list is how a merchant ends up searching for a row that no longer exists.

If a row on that screen does not match what you see in Cloudflare's dropdown, tell us rather than picking the nearest match: a token missing one permission fails partway through setup.

What Fond collects

For each request the Worker reports the timestamp, the referrer's host, the page path, and the user agent. Three deliberate limits apply at the edge, inside your own Cloudflare account, before anything reaches Fond:

Query strings are reduced to an allowlist. Only utm_*, ref and gclid survive. Everything else is dropped at your edge, so an email address or an order id sitting in a query string never leaves your infrastructure. This is an allowlist rather than a blocklist, so a parameter nobody anticipated is dropped by default rather than forwarded by default.

Identifiers in the path are collapsed. A path like /account/reset/6789/9f8a... is reported as /account/reset/:id/:token. Ordinary product paths such as /products/blue-linen-shirt are untouched.

IP addresses are collected only for crawlers. An IP is kept only when the user agent matches a known AI crawler, so the published vendor IP ranges can confirm the bot is genuine. Human visits carry no IP.

Raw request rows are kept for 30 days and then deleted. The daily totals built from them are what persists, so your history survives without the underlying requests doing so.

What the Worker cannot see

Orders and revenue. Cloudflare does not run Workers on /checkout, so edge measurement cannot attribute a purchase. Revenue continues to come from your Google Analytics connection.

Anything inside the page. The Worker sees the request, not the session. It cannot tell you scroll depth, time on page, or which button someone clicked.

Visits from inside an assistant's mobile app. These arrive with no referrer at all, so no measurement method can attribute them to an engine unless that engine tags its own links. This is a limit of how answer engines work rather than of your setup, and it means your real figure is higher than any tool shows you.

Traffic that does not pass through Cloudflare. If part of your store is served from somewhere else, the Worker never sees it.

Removing it

Disconnecting deletes the Worker route and the script from your Cloudflare account first, using your token, and only then discards the token. Fond then shows you a restore checklist seeded with the settings it captured before any change was advised.

Read that checklist rather than reverting everything by reflex. In particular, turning Always Use HTTPS back on will break certificate renewal again in exactly the way described above, whether or not Fond is still connected.

Data already collected is kept, and reconnecting the same domain resumes where it left off.