Proxy the script through your domain

Ad blockers keep lists of analytics domains and block scripts loaded from them. When the script and the endpoint it sends to live on your own domain, most blockers let them through.

How the proxy works

You forward two paths on your domain to Revfaro:

You can pick any path. Neutral names such as /stats/ work better than words blockers look for, like analytics or tracking.

Events then reach Revfaro from your server. The proxy must send:

• the User-Agent header, and
• the visitor's IP address, in X-Revfaro-Visitor-IP, X-Vercel-Forwarded-For, or X-Forwarded-For (in that order), and
• your site's proxy key, in X-Revfaro-Proxy-Secret.

Revfaro needs the address for IP exclusions, cookieless visitors and its per-visitor limits, and never stores it.

Location reporting: Revfaro only trusts Cloudflare location information for the connecting visitor. When your proxy forwards a visitor's address, Cloudflare sees the proxy, so Revfaro leaves the visitor's location unknown. Vercel location headers are not used. For location reporting, send events directly to Revfaro's Cloudflare-protected hostname.

Set up the proxy

In Website settings → Tracking, enable First-party proxy and copy the proxy key into a server-only environment variable named REVFARO_PROXY_SECRET. Never put it in HTML, browser code, or a NEXT_PUBLIC_ variable. Without the matching key, forwarded IP headers are ignored and the sender gets the direct-visitor limit.

module.exports = {
  async rewrites() {
    return [{ source: '/stats/script.js', destination: 'https://revfaro.com/js/script.js' }];
  },
};

export async function POST(request) {
  const response = await fetch('https://revfaro.com/api/event', {
    method: 'POST',
    headers: {
      'Content-Type': 'text/plain',
      'User-Agent': request.headers.get('user-agent') ?? '',
      'X-Vercel-Forwarded-For': request.headers.get('x-vercel-forwarded-for') ?? '',
      'X-Revfaro-Proxy-Secret': process.env.REVFARO_PROXY_SECRET,
    },
    body: await request.text(),
  });
  return new Response(null, { status: response.status });
}

location = /stats/script.js {
    proxy_pass https://revfaro.com/js/script.js;
    proxy_ssl_server_name on;
}
location = /stats/event {
    proxy_pass https://revfaro.com/api/event;
    proxy_ssl_server_name on;
    proxy_set_header X-Revfaro-Visitor-IP $remote_addr;
    proxy_set_header X-Revfaro-Proxy-Secret "YOUR_SERVER_ONLY_PROXY_KEY";
    proxy_set_header Cookie "";
}

export default {
  async fetch(request, env) {
    const { pathname } = new URL(request.url);
    if (pathname === '/stats/script.js') return fetch('https://revfaro.com/js/script.js');
    if (pathname === '/stats/event') {
      return fetch('https://revfaro.com/api/event', {
        method: 'POST',
        headers: {
          'Content-Type': 'text/plain',
          'User-Agent': request.headers.get('User-Agent') ?? '',
          'X-Revfaro-Visitor-IP': request.headers.get('CF-Connecting-IP') ?? '',
          'X-Revfaro-Proxy-Secret': env.REVFARO_PROXY_SECRET,
        },
        body: await request.text(),
      });
    }
    return fetch(request);
  },
};

Then change your script tag: load the script from your domain and send events there with data-api:

<script defer data-website-id="YOUR_SITE_ID" data-api="/stats/event" src="/stats/script.js"></script>

Deploy, open your site and check that a request to /stats/event returns 202 in your browser's Network tab. Verify your installation has the details.

Limits behind a proxy

Every visitor behind your authenticated proxy gets the same limit as a visitor who connects directly: 1,200 events every 10 minutes per website. On top of that, one proxy address can forward up to 30,000 events every 10 minutes for one website.

If your proxy doesn't pass the visitor's address, everything arrives from your server's address: IP exclusions can't match visitors, cookieless mode counts everyone with the same browser as one visitor, and a busy site reaches the per-address limit quickly. Always forward the correct address; a proxy server's location is not a visitor's location.

Serve the cookieless script

The same setup works for cookieless mode: point the script path at https://revfaro.com/js/script.cookieless.js and keep everything else as it is. Keep the authenticated event server route; a script rewrite alone does not forward your visitors' addresses.

For self-hosted Revfaro behind Coolify, the deployment proxy must also preserve and validate the sender address. See the deployment guide: Traefik can replace forwarded headers by default. A site proxy key does not configure your infrastructure proxy.