Documentation

First-party proxy: Vercel and Netlify rewrites guide

Serve /af/script.js and /af/event from the customer's site and rewrite those paths to AnalyticFast. The browser stays on the customer's origin, which is what gets past most blocker lists. The event's u field is still the page URL and must be an allowed hostname.

Checked 2026-10-26:

• Vercel project rewrites: https://vercel.com/docs/project-configuration/vercel-json#rewrites
• Netlify rewrites and proxies: https://docs.netlify.com/manage/routing/redirects/rewrites-proxies/

Vercel

vercel.json at the customer project root:

{
  "rewrites": [
    { "source": "/af/script.js", "destination": "https://YOUR_ANALYTICS_HOST/js/script.js" },
    { "source": "/af/event", "destination": "https://YOUR_ANALYTICS_HOST/api/event" }
  ]
}

Vercel sets x-vercel-ip-country, x-vercel-ip-country-region, x-vercel-ip-city, x-vercel-ip-latitude and x-vercel-ip-longitude on requests it proxies. AnalyticFast already prefers those for city-level coordinates (geoOf in src/worker/collect.ts) and rounds lat/lon to two decimals. It does not store an address.

Netlify

_redirects (a status of 200 is a rewrite, not a redirect):

/af/script.js  https://YOUR_ANALYTICS_HOST/js/script.js  200
/af/event      https://YOUR_ANALYTICS_HOST/api/event     200

Or netlify.toml:

[[redirects]]
  from = "/af/script.js"
  to = "https://YOUR_ANALYTICS_HOST/js/script.js"
  status = 200
  force = true

[[redirects]]
  from = "/af/event"
  to = "https://YOUR_ANALYTICS_HOST/api/event"
  status = 200
  force = true

force = true matters when a file already exists at that path. See Netlify's shadowing notes on the same page.

Script tag

<script defer data-website-id="YOUR_SITE_ID"
  data-api="https://example.com/af/event"
  src="https://example.com/af/script.js"></script>

Use the customer's public origin in src and data-api. Relative /af/event also works when the page is served from that same origin.

These rewrites cannot strip cookies. /api/event does not read or store them. Do not add the visitor address to the proxied request. Cookieless mode hashes the address AnalyticFast actually sees, which behind Vercel or Netlify is the platform egress, so many visitors can share one daily id. Use cookies unless that collision is acceptable.

Rate limit behind a proxy

Hosted AnalyticFast limits ingest per sender address, about 300 events per 10 seconds per site in each Cloudflare location. Pings don't count toward it. Behind this proxy, every visitor reaches AnalyticFast from the proxy's address, so the whole site shares that one allowance. That covers a site with roughly a thousand visitors active at the same moment. Above that, events are dropped silently with a 202, and the customer's site never sees an error. If you expect more traffic than that, load the script directly instead of through the proxy, or ask the operator about a higher limit.