Cloudflare setup
Run self-hosted analytics behind Cloudflare
Cloudflare can provide DNS, TLS termination, and edge security in front of a self-hosted analytics origin. It can also break collection when ingestion requests are cached, challenged, rate-limited, rewritten, or blocked without an end-to-end test.
Published Technical guide by Vectr4
Category
Self-hosted analytics
Product focus
Events, funnels, sessions, journeys
Deployment
Your VPS with Docker Compose
01
Start with DNS and strict TLS
Create a dedicated analytics hostname and point it to the origin or tunnel. Use a valid origin certificate and prefer strict certificate validation. Do not use a mode that leaves the Cloudflare-to-origin connection unencrypted.
02
Do not cache ingestion requests
Analytics collection endpoints accept changing request bodies and must reach the origin. Exclude ingestion and authenticated application routes from cache rules. Cache only static assets with an explicit policy.
- Bypass cache for event ingestion paths.
- Preserve query strings and request bodies required by the SDK.
- Confirm allowed HTTP methods reach the origin.
- Set body-size limits above valid event payloads but below abusive sizes.
03
Tune security controls deliberately
Bot controls, browser challenges, WAF rules, and rate limits can reject legitimate SDK traffic because collection requests are not interactive browser navigations. Create narrow rules for known analytics paths rather than disabling protection for the whole hostname.
04
Preserve the public origin
Forward the real host, client protocol, and appropriate client address headers. The application may use these values for secure cookies, redirects, origin checks, or logs. Trust proxy headers only from the proxy network you actually operate.
05
Verify through Cloudflare, not around it
After following the Docker installation guide, submit a known event through the public Cloudflare hostname. Confirm the response status, inspect origin logs, and verify the event appears in the dashboard. Repeat after changing WAF, cache, TLS, or rate-limit rules.
- Continue with the complete self-hosting analytics guide.
- Learn how the deployment supports self-hosted product analytics.
FAQ
Frequently asked questions
Should Cloudflare cache analytics ingestion?
No. Event ingestion requests should bypass cache and reach the origin. Static JavaScript and images can use explicit cache policies.
Can Cloudflare challenges block analytics?
Yes. Interactive challenges, bot controls, WAF rules, and rate limits can reject legitimate collection traffic. Test the exact SDK request path after every relevant rule change.
Should I use a Cloudflare Tunnel?
A tunnel can avoid exposing an origin IP directly, but it adds another service and configuration layer. Evaluate availability, trust, routing, and recovery tradeoffs for your deployment.