> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Reverse proxy – Session Replay pocket guide

Canonical URL: https://posthog.com/learn/session-replay/pocket-guide/reverse-proxy

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://app.posthog.com` (app host for links).

Chapter 04

# Reverse proxy – Session Replay pocket guide

Ad blockers keep lists of know analytics domains and block requests to them. This will result in incomplete or missing replays being captured. Using a [reverse proxy](https://posthog.com/docs/advanced/proxy.md) lets you route through your own domain, so captures are not blocked.

## Set up a reverse proxy

PostHog runs a free, [managed proxy](https://posthog.com/docs/advanced/proxy/managed-reverse-proxy.md) for you. It sits on a subdomain you own, and PostHog handles the SSL certificate, the routing, and the maintenance.

[Set up a managed proxy](https://app.posthog.com/settings/organization-proxy)

Two important things to decide with your team while setting it up:

**Pick a boring subdomain.** Anything containing `analytics`, `tracking`, `telemetry`, `posthog`, or `ph` is already on the block lists you're trying to avoid.

**Turn your DNS provider's own proxy off.** On Cloudflare that's the grey cloud, not the orange one. Leaving it on breaks certificate provisioning.

## Limits of a proxy

The managed proxy routes traffic through Cloudflare, a listed [subprocessor](https://posthog.com/subprocessors.md) in our [DPA](https://posthog.com/dpa.md). It's also not [HIPAA](https://posthog.com/docs/privacy/hipaa-compliance.md)\-compliant, so a [BAA](https://posthog.com/docs/privacy/hipaa-compliance.md) with PostHog doesn't cover it – run your own if you handle [PHI](https://posthog.com/docs/privacy/hipaa-compliance.md).

DNS-level blocking follows your subdomain's CNAME chain, sees where it really points, and drops the request before the browser is involved. That needs a custom resolver like NextDNS or Pi-hole, so it's a small share of users, and no proxy gets around it. Browser extensions can't do this – they only see HTTP requests after DNS has already resolved.

Your own [`Content-Security-Policy`](https://posthog.com/docs/advanced/content-security-policy.md) will also stop `recorder.js` from being served. To make sure this doesn't happen, read or point your agent at [this docs page](https://posthog.com/docs/advanced/content-security-policy.md).

See also: [Deploy a reverse proxy](https://posthog.com/docs/advanced/proxy.md) · [Managed reverse proxy](https://posthog.com/docs/advanced/proxy/managed-reverse-proxy.md) · [Content security policy](https://posthog.com/docs/advanced/content-security-policy.md) · [Replay troubleshooting](https://posthog.com/docs/session-replay/troubleshooting.md)