# Amazon CloudFront

Two behaviours in your distribution serve the script from your domain and pass its counts on, with CloudFront’s own headers saying where each visitor is.

In your distribution, add `fiveb.ar` as an origin, reached at `https://fiveb.ar` only, and two behaviours sending `/js/tally.js` and `/api/tally` to it. For `/api/tally`, allow `POST`, and choose the `CachingDisabled` cache policy and an origin request policy of your own that sends only the `User-Agent` and `Origin` headers, so that fiveb.ar gets its own name as the host and none of your site’s cookies. CloudFront adds the visitor’s address to `X-Forwarded-For`. To say where they are too, have the policy also send `CloudFront-Viewer-Country`, `CloudFront-Viewer-City` and `CloudFront-Viewer-ASN`, which fivebar reads as it does its own. See [CloudFront’s help on its headers](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/adding-cloudfront-headers.html).

## Load the script

Once the proxy is live, load the script from your own domain. It sends its counts to the host it was loaded from, so nothing else changes:

```
<script async data-domain="example.com" src="/js/tally.js"></script>
```

Then [check it works](https://fiveb.ar/docs/proxy.md#check-it-works). If either path is already taken on your site, see [Other paths](https://fiveb.ar/docs/proxy.md#other-paths). [Proxying](https://fiveb.ar/docs/proxy.md) says how it works and which headers name the visitor.

---

fivebar is web analytics without cookies, at https://fiveb.ar. Every page of its docs is listed at https://fiveb.ar/docs/index.md.