A reverse proxy is a server that sits in front of one or more web servers and handles incoming requests on their behalf. Visitors connect to the reverse proxy, the proxy forwards each request to the right server behind it, and then passes the response back. The visitor never talks to the real server directly.
If you have loaded a large website today, you have almost certainly gone through one without noticing. Here is what it does, why sites use it, and how it differs from a regular proxy and from a VPN.
How a Reverse Proxy Works: A Simple Example
Think of a hotel reception desk. Guests do not wander the building looking for the right staff member. They speak to reception, and reception routes each request to housekeeping, the kitchen or maintenance, then brings back the answer.
On the web the steps look like this:
- You type a website address. Your browser looks up its IP address, which actually belongs to the reverse proxy.
- Your request arrives at the reverse proxy.
- The proxy checks it, decides which backend server should handle it, and forwards it.
- The backend server builds the page and returns it to the proxy.
- The proxy sends the page to you, often after compressing or caching it.
From your side it looks like one server. Behind the proxy there may be two servers or two thousand.
What Is a Reverse Proxy Used For? The Main Benefits
- Load balancing. Traffic is spread across several servers so that no single one is overwhelmed, and a failed server can be skipped automatically.
- Security. The real servers’ IP addresses stay hidden. The proxy can filter malicious requests and absorb denial-of-service attacks before they reach the application.
- Handling encryption. The proxy manages HTTPS certificates and does the encrypting and decrypting, a job known as TLS termination, which takes that work off the backend servers.
- Caching. Copies of images, scripts and pages are stored and served directly, which makes the site faster.
- Compression. Responses are shrunk before they are sent, saving bandwidth.
- One address for many services. A single domain can route /shop to one application and /blog to another.
Cloudflare’s learning centre has a clear illustrated overview of what a reverse proxy does if you want to go deeper.
Reverse Proxy vs Forward Proxy: Which Side Does It Protect?
The two are mirror images. A forward proxy, which is what most people mean when they just say “proxy”, sits in front of users. A reverse proxy sits in front of servers.
| Forward proxy | Reverse proxy | |
|---|---|---|
| Sits in front of | Users or client devices | Web servers |
| Who sets it up | The user, a school or a company network | The website owner |
| Hides | The user’s IP address from websites | The server’s IP address from visitors |
| Typical uses | Content filtering, access control, basic privacy | Load balancing, security, speed |
| Does the visitor know it is there? | Yes, it is configured on their device or network | Usually not |
Reverse Proxy vs VPN: Two Tools for Opposite Jobs
People often mix these up because both involve traffic passing through a middle server. They solve different problems.
- A VPN protects the person browsing. It encrypts everything leaving your device and hides your IP address from the sites you visit. Our guide to what a VPN is and how it works covers this.
- A reverse proxy protects the website. It does nothing for your privacy as a visitor, and you cannot choose to use one or avoid one.
The two can work together. A company might put its internal tools behind a reverse proxy and also require staff to connect over a VPN that uses a protocol such as IPsec before they can reach it.
Common Reverse Proxy Software and Services
- Nginx. One of the most widely used web servers and reverse proxies. Its documentation includes a guide to configuring Nginx as a reverse proxy.
- HAProxy. Known for high-performance load balancing.
- Apache HTTP Server with its proxy modules.
- Caddy and Traefik. Popular with self-hosters and container setups because they obtain HTTPS certificates automatically.
- Cloudflare and other content delivery networks. These are reverse proxies run as a service, with servers around the world.
When You Might Want to Set Up Your Own Reverse Proxy
- You run several apps on a home server and want each on its own subdomain with HTTPS.
- Your website has outgrown one server and you need to share traffic between two or more.
- You want to hide your origin server’s address and add a layer of filtering in front of it.
- You want to cache content to cut load times.
For a single small site on shared hosting, you do not need to build one. Your host or a free CDN plan already provides it.
The Risks and Limits of Using a Reverse Proxy
- It becomes a single point of failure. If the proxy goes down, everything behind it is unreachable, so larger setups run more than one.
- It sees all traffic unencrypted when it handles TLS, which means it must be secured and trusted.
- Misconfiguration can expose things. A wrong rule can route visitors to an internal service that was never meant to be public.
- It adds a small delay to each request, usually outweighed by caching gains.
Frequently Asked Questions About Reverse Proxies
Is a reverse proxy the same as a load balancer?
Not exactly. Load balancing is one job a reverse proxy can do. A reverse proxy also handles caching, encryption and filtering, and it is useful even with a single backend server.
Does a reverse proxy hide my IP address when I browse?
No. It hides the website’s servers, not you. To hide your own IP address you need a VPN or a forward proxy.
Is Cloudflare a reverse proxy?
Yes. When a site uses Cloudflare, visitors connect to Cloudflare’s servers, which forward requests to the site’s real server.
Is a reverse proxy free?
The main software options, including Nginx, HAProxy, Caddy and Traefik, are open source and free to use. You pay only for the server they run on, or for a managed service if you choose one.