> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Reverse proxy – Session replay pocket guide

[](/pocket-guides.md)Aa

[](/pocket-guides/session-replay/protecting-user-privacy.md)[](/pocket-guides/session-replay/finding-replays.md)

# Reverse proxy – Session replay pocket guide

Ad blockers keep lists of know analytics domains and block requests to them. This will result in incomplete or missing replays being captured. Using a [reverse proxy](/docs/advanced/proxy.md) lets you route through your own domain, so captures are not blocked.

## Set up a reverse proxy

PostHog runs a free, [managed proxy](/docs/advanced/proxy/managed-reverse-proxy.md) for you. It sits on a subdomain you own, and PostHog handles the SSL certificate, the routing, and the maintenance.

[Set up a managed proxy](https://app.posthog.com/settings/organization-proxy)

Two important things to decide with your team while setting it up:

**Pick a boring subdomain.** Anything containing `analytics`, `tracking`, `telemetry`, `posthog`, or `ph` is already on the block lists you're trying to avoid.

**Turn your DNS provider's own proxy off.** On Cloudflare that's the grey cloud, not the orange one. Leaving it on breaks certificate provisioning.

## Limits of a proxy

The managed proxy routes traffic through Cloudflare, a listed [subprocessor](/subprocessors.md) in our [DPA](/dpa.md). It's also not [HIPAA](/docs/privacy/hipaa-compliance.md)\-compliant, so a [BAA](/docs/privacy/hipaa-compliance.md) with PostHog doesn't cover it – run your own if you handle [PHI](/docs/privacy/hipaa-compliance.md).

DNS-level blocking follows your subdomain's CNAME chain, sees where it really points, and drops the request before the browser is involved. That needs a custom resolver like NextDNS or Pi-hole, so it's a small share of users, and no proxy gets around it. Browser extensions can't do this – they only see HTTP requests after DNS has already resolved.

Your own [`Content-Security-Policy`](/docs/advanced/content-security-policy.md) will also stop `recorder.js` from being served. To make sure this doesn't happen, read or point your agent at [this docs page](/docs/advanced/content-security-policy.md).

See also: [Deploy a reverse proxy](/docs/advanced/proxy.md) · [Managed reverse proxy](/docs/advanced/proxy/managed-reverse-proxy.md) · [Content security policy](/docs/advanced/content-security-policy.md) · [Replay troubleshooting](/docs/session-replay/troubleshooting.md)

[‹ Privacy](/pocket-guides/session-replay/protecting-user-privacy.md)[All guides](/pocket-guides.md)p. 4 of 7[Finding replays ›](/pocket-guides/session-replay/finding-replays.md)