- Use the correct endpoint (analytics.mattitja.se instead of the
non-existent .cloud domain)
- Authenticate with the site ingest secret as a Bearer token so the API
trusts the forwarded visitor IP and user agent
- Forward the visitor Accept-Language header (required by bot detection)
- Only track successful GET requests rendering HTML
- Short timeouts and a file-based circuit breaker that pauses sending
after connection failures or 5xx responses, so no queue, worker or
cache is needed and a down API never slows the host site
- Log rejected requests instead of failing silently
mathiaspalmqvist