First-party proxy (anti-adblock)

By default, the Takt tracker and event collection already go through a Takt domain, not a path known to blockers. You can go further: serve the script and the collection endpoint from your own domain, through your reverse proxy or CDN. All analytics traffic then becomes indistinguishable from your site — ad blockers can no longer isolate it.

Tier 1 — served by Takt

The install snippet already loads the tracker from a Takt domain. Nothing to do.

Tier 2 — manual proxy (advanced)

You route a path of your own domain to the Takt edge yourself, certificate and config on your side.

The tracker (/takt.js, /takt.auto.js) and the collection endpoint (/api/event) are served by the same ingestion service, through the edge. A manual proxy must route both paths.

Tier 2 — manual proxy

If you already run a reverse proxy or a CDN, route a path of your own domain to the Takt edge yourself, preserving the Host header. Route /_takt/* to https://collect.taktlytics.com/: both ingestion-served paths (/takt.js / /takt.auto.js and /api/event) will flow through your route.

Preserving the visitor IP

With a proxy, your reverse proxy becomes the immediate client of the ingestion. Without care, every visitor would collapse onto its IP, skewing unique-visitor counts and geolocation. To avoid this, each config below forwards the real visitor IP via the X-Takt-Client-IP header, then you enable the relay on the Takt side.

The forwarded IP is ephemeral: Takt only uses it to derive the daily visitor identifier (hashed, cookieless) and the geolocation country. It is never stored on the event. Then enable Settings → First-party & anti-adblock → "I proxy Takt myself" so the ingestion reads that header.

Only proxies that can inject a dynamic header are supported (Cloudflare, Nginx, Apache, Caddy). A plain static rewrite (e.g. Netlify _redirects, Vercel rewrites) cannot add the visitor IP and would skew counts — don't use it with the relay enabled.

Cloudflare — Origin Rule + Transform Rule

# Origin Rule — proxy /_takt/* to the Takt edge
Source path:   /_takt/*
Destination:   https://collect.taktlytics.com/$1
Host header:   rewrite to collect.taktlytics.com

# Transform Rule — add the real visitor IP
Set dynamic header:  X-Takt-Client-IP = ip.src

Nginx — location

location /_takt/ {
    proxy_pass         https://collect.taktlytics.com/;
    proxy_set_header   Host              collect.taktlytics.com;
    proxy_set_header   X-Takt-Client-IP  $remote_addr;
    proxy_ssl_server_name on;
}

Apache — mod_proxy

<Location /_takt/>
    SSLProxyEngine On
    ProxyPreserveHost Off
    RequestHeader set X-Takt-Client-IP "%{REMOTE_ADDR}s"
    ProxyPass        https://collect.taktlytics.com/
    ProxyPassReverse https://collect.taktlytics.com/
</Location>

Caddy — reverse_proxy

handle_path /_takt/* {
    reverse_proxy https://collect.taktlytics.com {
        header_up Host {upstream_hostport}
        header_up X-Takt-Client-IP {remote_host}
    }
}

The Host header must be collect.taktlytics.com, never your own domain: it is what routes the request to the ingestion. Your site is identified by the domain carried in the event, not by the Host. Once the route is in place, point your snippet at /_takt/takt.js so the script and collection travel through your domain.

Verification & troubleshooting

To confirm everything works:

In your browser’s network tab, the tracker loads from your domain (/_takt/…), not from a Takt domain.
A navigation triggers a /_takt/api/event request returning 2xx, and the visitor shows up live in the dashboard.

Common issues:

Symptom	Likely cause	Fix
`403` on `/_takt/api/event`	Your `Host` is forwarded as-is instead of being rewritten	Force `Host: collect.taktlytics.com` in your config (on Apache, `ProxyPreserveHost Off`)
Every visitor counted as one	`X-Takt-Client-IP` header missing or relay disabled	Add the header in your config and enable “I proxy Takt myself”
Tracker doesn’t load	Wrong proxy target	Check the route points to `collect.taktlytics.com`

What’s next

The script — the base snippet and window.takt.
Privacy — why everything stays cookieless, even first-party.