Tutorial · 25 August 2026
Serve /cf.js from your hostname so list blockers miss it
Most blockers match lists, not intent. googletagmanager.com is on the list. cookiefreeanalytics.com can be too. yoursite.com/cf.js usually is not. First-party is how you stop a blunt list from eating the count — not how you hide from someone who turned JavaScript off.
Cookie Free Analytics ships two methods. Path: a rewrite on the site you already have. Subdomain: c.yoursite.com CNAME to cname.vercel-dns.com. Pick one. The setup page turns the other off when you save. Two methods at once is how people get a 301 they then debug for a week.
What “Check now” actually looks for
We fetch your first-party URL and look for our marker. We pin the lookup to the public IP we just resolved, so a later DNS answer cannot swap the host. When the file is ours, the snippet in site settings stops pointing at our hostname.
If Check fails after a CNAME, wait for the certificate. We attach the hostname to the Frankfurt project and issue HTTPS. A failed GET from our functions to our own custom domain is hairpin — it does not override an issued cert.
The steps
- 1
Add the site and paste the default snippet
Create the site in Cookie Free Analytics. The default snippet loads /cf.js from our hostname. Hits should land. This is enough to prove the dashboard before you fight blockers.
- 2
Pick Path or Subdomain, not both
Open Serve from your domain. Path rewrites /cf.js and /api/collect on the host you already have. Subdomain is a CNAME of c.yoursite.com to cname.vercel-dns.com (DNS only, not proxied). Saving one turns the other off.
- 3
Do not 301 the snippet
A rewrite returns 200 on your hostname. A redirect to our hostname is a gift to list blockers — they follow it. Apex already serves /cf.js as 200; pages still 308 to www.
- 4
Check until the marker is ours
Press Check now. We look for the cookiefree-cf marker on your /cf.js. When it is ours, the snippet in the dashboard switches itself. WordPress: upload the plugin and the path is done. Shopify: CNAME or app proxy.
Questions
- Does first-party defeat every blocker?
- No. List-based blockers miss a first-party host. Brave, strict tracking prevention, and JavaScript off still drop the beacon. First-party recovers the blunt hostname list, not a determined block.
- Is CNAME on Hobby?
- Yes. Path and c. CNAME are on Hobby, Starter, and Growth.