Keitaro is the affiliate marketer's workhorse, but by default the tracker domain points straight at your server's IP. Everyone can see that address: ad networks during review, competitors through services like SecurityTrails, anti-fraud systems and bots that scan IP ranges looking for trackers. Once the IP is exposed, all of your domains and campaigns get tied to it at once.
Why an exposed tracker IP is a problem
- Campaign linking. One IP behind several tracker domains lets a moderator or competitor see your whole network at a glance.
- Abuse and load hit the origin. A direct IP can be buried under junk traffic, flooded with postbacks or dumped onto a block list.
- The history sticks around. Passive DNS keeps the domain-to-IP mapping on record for months, even after you migrate.
- Recon before the launch. Spy tools and scanners find the bare tracker and monitor whatever you run.
How a reverse proxy hides the origin
A reverse proxy sits between the visitor and your Keitaro server. The tracker domain points at the proxy IP; the proxy accepts the request, adds protection and forwards it to the origin over an address only it knows. From the outside — in DNS, in headers, during scanning — only the proxy is visible. The real server stays private.
Privateflare is a self-hosted reverse proxy, WAF, CDN and DNS in one dashboard, with native Keitaro support. You get a hidden origin, bot filtering and auto-SSL, while the infrastructure stays yours — your traffic data never leaves for third parties.
How to hide your Keitaro IP with Privateflare
- Add the tracker domain in the Privateflare dashboard and set the origin — the private IP or address of your Keitaro server.
- Switch the NS or A record to Privateflare. Publicly the domain now resolves to the proxy, not to the tracker.
- Set caching to bypass for the tracker so every click and postback is processed in real time.
- Enable bot filtering and the WAF — scanners and junk traffic are cut off before they reach the origin.
- Firewall the origin to allow only the proxy IP. Direct requests to the server stop working.
SSL for the tracker domain is issued and renewed automatically, and the visitor's real IP is forwarded in the headers — so your Keitaro stats stay correct.
What you get
- Your Keitaro server's real IP is invisible in DNS and to scanning.
- Campaigns and domains are no longer linked to each other through a shared origin.
- Bots and scanners are filtered at the proxy layer.
- The origin is protected from direct abuse and parasitic load.
- Keitaro clicks, redirects and postbacks work without conflicts.
FAQ
Why hide the Keitaro tracker IP at all?
An exposed IP lets ad-network moderation, competitors and anti-fraud scanners link all of your campaigns, domains and landing pages together, and lets them load and attack the server itself. A reverse proxy hides the origin — only the proxy IP is visible externally.
How exactly does a reverse proxy hide the real IP?
The domain points at the proxy IP, not at the Keitaro server. The proxy accepts requests and forwards them to the origin over a private address. In DNS, in responses and during scanning only the proxy is visible; the origin is reachable by the proxy alone.
Will clicks and postbacks break?
No. Privateflare is natively compatible with Keitaro: the visitor's real IP is forwarded in headers, so clicks, redirects and postbacks work without conflicts. Caching for the tracker is disabled so every click is processed in real time.
Do I need a separate SSL certificate?
No. Privateflare issues and automatically renews a free SSL certificate for the tracker domain — there is no need to configure certificates by hand.