Documentation

First-party proxy: Next.js rewrites guide

A Next.js rewrite is a proxy. The browser requests the customer's host, and Next.js fetches AnalyticFast. Use beforeFiles so a real page or public file cannot shadow the paths.

Checked 2026-10-26: next.config.js rewrites, including "Rewriting to an external URL".

next.config.js

const ANALYTICS = 'https://YOUR_ANALYTICS_HOST';

module.exports = {
  async rewrites() {
    return {
      beforeFiles: [
        { source: '/af/script.js', destination: `${ANALYTICS}/js/script.js` },
        { source: '/af/event', destination: `${ANALYTICS}/api/event` },
      ],
    };
  },
};

If basePath is set, external rewrites need basePath: false on each rule or Next.js prefixes the source. The docs page shows that flag.

If trailingSlash: true, the docs require the trailing slash in source as well. /af/event would not match /af/event/.

Script tag

In the root layout (App Router), point the existing tracker at the rewritten paths:

import Script from 'next/script';

export function Analytics() {
  return <Script src="/af/script.js" data-website-id="YOUR_SITE_ID" data-api="/af/event" strategy="afterInteractive" />;
}

Do not also call init() from the npm package on the same page. The page URL sent as u must be an allowed hostname for the site. The rewrite destination is not that check.

Next.js will forward incoming headers. AnalyticFast ignores X-Forwarded-For and does not store a client address. On Vercel, the x-vercel-ip-* headers are the ones collection already uses for coarse location. See Vercel and Netlify.

Cookieless mode is a poor fit behind this proxy: the address AnalyticFast can hash is the server that performed the rewrite, not each browser. Leave cookieless off unless that collapse is acceptable.

Rate limit behind a proxy

Hosted AnalyticFast limits ingest per sender address, about 300 events per 10 seconds per site in each Cloudflare location. Pings don't count toward it. Behind this proxy, every visitor reaches AnalyticFast from the proxy's address, so the whole site shares that one allowance. That covers a site with roughly a thousand visitors active at the same moment. Above that, events are dropped silently with a 202, and the customer's site never sees an error. If you expect more traffic than that, load the script directly instead of through the proxy, or ask the operator about a higher limit.