This FAQ details the few different use cases and configurations when using a proxy in Matomo (Piwik).
If Matomo is behind a reverse proxy
If you install Matomo, connecting through a reverse proxy (https-to-http), the following line should be automatically added to your config/config.ini.php file during the Matomo installation:
[General] assume_secure_protocol = 1
If you install Matomo from behind the reverse proxy (where Matomo can’t detect https will be used), you should set the above manually. Also, depending on your proxy server, the Visitor IP is set in a different HTTP Header which should also be automatically detected on install and added to your config/config.ini.php:
[General] ; Uncomment line below if you use a standard proxy ;proxy_client_headers = HTTP_X_FORWARDED_FOR ;proxy_host_headers = HTTP_X_FORWARDED_HOST ; Uncomment line below if you use CloudFlare ;proxy_client_headers = HTTP_CF_CONNECTING_IP ; Uncomment line below if you use another proxy (that sets Client-IP header) ;proxy_client_headers = HTTP_CLIENT_IP
If Matomo was unable to detect your proxy configuration, you may add these lines manually in your Matomo config.ini.php file (remove the leading “;” character to enable the setting).
Note: an alternative solution on Apache 2.4 and Apache 2.5 is to use
mod_remoteip to override the client IP with the IP as provided by a proxy or load balancer. Then you won’t need to specify these Matomo config settings.
If Matomo is behind a reverse proxy and installed in a sub-path
If you’re using Matomo behind a reverse proxy with a different path such as
rewrite ^/piwik/(.*)$ /$1 break; (in
nginx.conf when Matomo is installed in the
/piwik path), you would need to:
1) configure your web server to provide a header
HTTP_X_FORWARDED_URI. For example on NGINX, when Matomo is installed in
/piwik path, you would set
proxy_set_header X-Forwarded-Uri /piwik; in your
2) configure Matomo to read this HTTP_X_FORWARDED_URI to construct correct URLs. In Matomo config/config.ini.php in the
[General] section add:
[General] ; Use the header HTTP_X_FORWARDED_URI to construct the current script name proxy_uri_header = 1
Matomo is behind an outgoing proxy
If your server is configured behind an outgoing proxy, check out this FAQ: outgoing Proxy easy setup in Matomo.
You might also be interested in How do I force Matomo login to use SSL (https)?.