Reverse proxy

Ad blockers keep lists of know analytics domains and block requests to them. This will result in incomplete or missing replays being captured. Using a reverse proxy lets you route through your own domain, so captures are not blocked.

Set up a reverse proxy

PostHog runs a free, managed proxy for you. It sits on a subdomain you own, and PostHog handles the SSL certificate, the routing, and the maintenance.

Two important things to decide with your team while setting it up:

Pick a boring subdomain. Anything containing analytics, tracking, telemetry, posthog, or ph is already on the block lists you're trying to avoid.

Turn your DNS provider's own proxy off. On Cloudflare that's the grey cloud, not the orange one. Leaving it on breaks certificate provisioning.

Limits of a proxy

The managed proxy routes traffic through Cloudflare, a listed subprocessor in our DPA. It's also not HIPAA-compliant, so a BAA with PostHog doesn't cover it – run your own if you handle PHI.

DNS-level blocking follows your subdomain's CNAME chain, sees where it really points, and drops the request before the browser is involved. That needs a custom resolver like NextDNS or Pi-hole, so it's a small share of users, and no proxy gets around it. Browser extensions can't do this – they only see HTTP requests after DNS has already resolved.

Your own Content-Security-Policy will also stop recorder.js from being served. To make sure this doesn't happen, read or point your agent at this docs page.