Skip to content

feat(www): proxy Plausible through usewraith.xyz, document dashboard access - #119

Open
Noubata wants to merge 1 commit into
wraith-protocol:developfrom
Noubata:feat/analytics-same-origin-proxy
Open

feat(www): proxy Plausible through usewraith.xyz, document dashboard access#119
Noubata wants to merge 1 commit into
wraith-protocol:developfrom
Noubata:feat/analytics-same-origin-proxy

Conversation

@Noubata

@Noubata Noubata commented Jul 30, 2026

Copy link
Copy Markdown

Summary

Closes #79.

Most of the cookie-less analytics work landed already in #47 (Plausible script, trackEvent() helper, Privacy page copy). This PR closes the remaining gaps against the ticket's acceptance criteria:

  • No cross-origin requests off our domain: the tracker script and event beacon previously loaded straight from plausible.io. vercel.json now proxies /js/script.js and /api/event to Plausible's servers server-side, and index.html loads the script from /js/script.js (same-origin). Plausible derives its event endpoint from the script's own origin, so events also post to usewraith.xyz/api/event automatically.
  • Public dashboard OR internal-only (contributor recommends): recommending internal-only — traffic/goal data isn't something visitors need to see and there's no reason to expose it to competitors. Documented in docs/CONTRIBUTING.md (team-invite access) and noted briefly in src/pages/Privacy.tsx.
  • Updated docs/CONTRIBUTING.md and src/pages/Privacy.tsx copy to reflect the proxy setup.

Note: this proxies Plausible's cloud service through our domain rather than self-hosting the Plausible app (Postgres/ClickHouse) itself — self-hosting would need real infra provisioning, out of scope for an S-tier ticket. The proxy achieves the same practical outcome (no cookies, no cross-origin requests, ad-blocker resilient).

Test plan

  • pnpm install && pnpm format:check && pnpm build (not run in this environment — no Node available)
  • pnpm dev, load every route, confirm in DevTools Network tab: script loads from usewraith.xyz/js/script.js, event beacons post to usewraith.xyz/api/event, zero requests to plausible.io
  • Confirm no cookies are set (Application tab)
  • Click through goal-tracked CTAs (Read the Docs, Try the Demo, Get API Key, Careers CTA) and confirm events register in the Plausible dashboard

…access

Closes wraith-protocol#79. Serves the analytics script and event beacon from our own
domain via vercel.json rewrites instead of plausible.io directly, so no
analytics request is cross-origin. Also documents that the Plausible
dashboard is internal-only rather than public.
@vercel

vercel Bot commented Jul 30, 2026

Copy link
Copy Markdown

@Noubata is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

@drips-wave

drips-wave Bot commented Jul 30, 2026

Copy link
Copy Markdown

@Noubata Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cookie-less analytics

1 participant