Skip to content

Add self-hosted Matomo analytics via first-party Worker proxy - #45

Merged
dubsector merged 2 commits into
mainfrom
matomo-analytics
Aug 2, 2026
Merged

Add self-hosted Matomo analytics via first-party Worker proxy#45
dubsector merged 2 commits into
mainfrom
matomo-analytics

Conversation

@dubsector

Copy link
Copy Markdown
Owner

Adds Matomo tracking for dubsector.dev, proxied through the Worker so the browser only ever talks to dubsector.dev.

Browser request Proxied to
/mtm/mtm.js $MATOMO_ORIGIN/matomo.js
/mtm/mtm.php $MATOMO_ORIGIN/matomo.php

Keeps the tracker off third-party blocklists and keeps the Matomo hostname out of the page source. The real visitor IP is forwarded as X-Forwarded-For.

  • Cookieless (disableCookies), honours Do Not Track.
  • Pageview plus a terminal / command event for each command a visitor types by hand (name = command line, truncated to 100 chars). Commands run by the scripted intro are not tracked.
  • With MATOMO_ORIGIN or MATOMO_SITE_ID unset, /api/analytics returns 204 and the client never loads the tracker, so local builds stay silent.

Before this does anything in production

npx wrangler secret put MATOMO_ORIGIN
npx wrangler secret put MATOMO_SITE_ID

Matomo also needs proxy_client_headers[] = HTTP_X_FORWARDED_FOR under [General] in config.ini.php, otherwise every visit is geolocated to a Cloudflare egress IP.

Testing

Ran wrangler dev locally against the real Matomo install:

  • unset vars: /api/analytics 204, no _paq, no tracker script, terminal renders normally
  • configured: /api/analytics 200, /mtm/mtm.js 200 (68 KB), pageview and e_c=terminal&e_a=command event hits both accepted 204 by Matomo

Loads the tracker from /mtm/mtm.js and sends hits to /mtm/mtm.php, both
proxied by the Worker to the Matomo install, so the browser only talks to
dubsector.dev and the Matomo hostname stays out of the page source. The
visitor IP is forwarded as X-Forwarded-For.

Tracking is cookieless and honours DNT. Beyond the pageview, each command
a visitor types by hand is sent as a terminal/command event; scripted
intro commands are not tracked. With MATOMO_ORIGIN or MATOMO_SITE_ID
unset, /api/analytics returns 204 and the client skips the tracker.
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 2, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
terminal 1bed75c Commit Preview URL

Branch Preview URL
Aug 02 2026, 03:24 AM

@dubsector
dubsector merged commit cb268cc into main Aug 2, 2026
6 checks passed
@dubsector
dubsector deleted the matomo-analytics branch August 2, 2026 03:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant