First-Party Proxy

Ad and tracker blockers — Brave Shields, uBlock Origin, Firefox Enhanced Tracking Protection — work primarily by matching the domain a request goes to. A page on yoursite.com that calls out to api.mitranalytics.dev is a textbook third-party request, and gets blocked for a real (and growing) share of visitors. Every client-side analytics tool has this problem — it isn't specific to Mitr.

The fix: make the request first-party. Your own server relays events to Mitr instead of the visitor's browser talking to api.mitranalytics.dev directly. The browser only ever sees yoursite.com, so there's no cross-origin request for a blocklist to catch.

How it works

The JS SDK already supports pointing at any base URL — this needs no SDK changes, just configuration:

Mitr.init('YOUR_SITE_ID', { baseUrl: 'https://yoursite.com/mitr-collect' });

Or, if you're using the auto-init script tag:

<script
  src="https://yoursite.com/vendor/mitr.js"
  data-site-id="YOUR_SITE_ID"
  data-base-url="https://yoursite.com/mitr-collect"></script>

Then set up a route on your own server/edge at that path which forwards the request to Mitr's real API. This is a plain server-to-server HTTP call — no CORS concerns, no cookies, nothing browser-specific about it. Pick any path you like; /mitr-collect is just an example.

Cloudflare Worker

If your site already runs on Cloudflare Pages/Workers, add a route for your proxy path pointing at this worker:

export default {
  async fetch(request) {
    const url = new URL(request.url);
    const target = 'https://api.mitranalytics.dev/api/v1' + url.pathname.replace('/mitr-collect', '') + url.search;

    return fetch(target, {
      method: request.method,
      headers: request.headers,
      body: request.method === 'GET' ? undefined : await request.arrayBuffer(),
    });
  },
};

Nginx

location /mitr-collect/ {
    proxy_pass https://api.mitranalytics.dev/api/v1/;
    proxy_set_header Host api.mitranalytics.dev;
    proxy_ssl_server_name on;
}

Vercel / Next.js

Add a rewrite in next.config.js:

module.exports = {
  async rewrites() {
    return [
      {
        source: '/mitr-collect/:path*',
        destination: 'https://api.mitranalytics.dev/api/v1/:path*',
      },
    ];
  },
};

What to avoid: CNAME cloaking

You may see other analytics vendors suggest pointing a DNS CNAME (e.g. stats.yoursite.com) at their infrastructure so it looks first-party at the DNS level, while the browser still connects directly to the vendor's servers. Don't use this approach with Mitr, or in general: it's specifically designed to evade tracker detection, and Brave and Firefox both now actively detect and block it (CNAME uncloaking — they resolve the alias back to its real target and apply blocklists to that). A real server-side reverse proxy, like the examples above, doesn't have this problem: your server is genuinely the one making the request, not disguising someone else's.

For events that must never be blocked

For critical events — a completed purchase, a signup — consider sending them from your own backend instead of the browser entirely, using the Node.js SDK. A server-to-server call has no browser in the loop at all, so there's nothing for a client-side blocker to catch regardless of proxy setup.