What is first-party proxy?

How does a first-party proxy work?

yoursite.com/a/tracker.js  →  vendor.com/tracker.js
yoursite.com/a/api/collect →  vendor.com/api/collect   (forward X-Forwarded-For)

Instead of loading https://analytics-vendor.com/script.js, your page loads https://yoursite.com/a/script.js. Your server or CDN forwards that request, and the script's data requests to /a/collect, to the vendor. Most frameworks and hosts support this with a rewrite rule (Next.js rewrites, Netlify and Vercel redirects, Cloudflare Workers, Nginx proxy_pass).

Why use a first-party proxy?

• Fewer blocked requests. Many blocklists match on known analytics domains; a request to your own domain often isn't matched.
• Content Security Policy. One less external origin to allow.
• Cookie lifetime. Some browsers treat cookies set via server responses on your domain more favorably than script-set ones.

The IP-forwarding catch

Through a proxy, every request reaches the vendor from your server's IP address. Unless the proxy forwards the visitor's real IP (typically in X-Forwarded-For), country detection breaks, bot filtering sees one IP for everyone, and IP-based cookieless hashing merges all visitors into one. Test with a VPN after setting it up.

Is proxying analytics ethical?

Proxying changes where requests go, not what's collected — so it's only as respectful as the analytics behind it. Routing privacy-preserving, first-party analytics through your own domain is common practice. Using a proxy to sneak invasive third-party tracking past a visitor's explicit choice (an ad blocker, or a refused consent banner) is not, and doesn't change your legal obligations.

First-party proxy with VisitTrack

The VisitTrack script sends events to the same origin it was loaded from (<script origin>/api/collect), so serving /tracker.js and /api/collect through a rewrite on your own domain makes both first-party; session replays, if enabled, load /replay.js from that origin too. There's no dedicated proxy guide in the docs yet, so treat it as an advanced setup: make sure your proxy passes the visitor's IP in X-Forwarded-For (VisitTrack reads the first entry), or locations, bot filtering and cookieless counting will be wrong. If your site sends a Content-Security-Policy, see the install guide.