What Is a Reverse Proxy? Examples and Use Cases

A reverse proxy is a server that sits in front of one or more web servers, receives visitors' requests on their behalf and forwards them to the right server behind it. The visitor never talks to the origin server directly, only to the reverse proxy. Teams use reverse proxies for load balancing, caching, TLS termination and to hide and protect their origin servers. This guide explains how a reverse proxy works, how it differs from the forward proxies used for privacy and data collection, what it is used for, and shows a working NGINX example.

How a Reverse Proxy Works

MDN describes reverse proxies as acting on behalf of servers, in contrast to forward proxies that act on behalf of clients. The flow looks like this:

1. A visitor requests https://www.example.com/. DNS points that name at the reverse proxy, not at the application server.
2. The reverse proxy receives the request and decides where to send it, based on rules such as the URL path, the hostname or server load.
3. It forwards the request to an origin server on the private network.
4. The origin responds to the reverse proxy, which returns the response to the visitor, possibly caching it first.

Because the origin's address is never exposed, attackers cannot target it directly, and you can change the servers behind the proxy without visitors noticing.

Reverse Proxy vs Forward Proxy

The proxies that BuyProxy sells are forward proxies: you route your own traffic through them. We do not sell reverse proxy software or hosting. For the forward side, see what a proxy server is.

What Reverse Proxies Are Used For

• Load balancing. NGINX's documentation notes that proxying is typically used to distribute load among several servers, and that load balancing is a common use of a reverse proxy.
• Caching. Serving repeated requests for static content from the proxy's cache reduces load on the origin.
• TLS termination. The proxy handles HTTPS encryption so application servers can speak plain HTTP on the private network.
• Security. Hiding origin IPs, filtering malicious requests and applying rate limits at the edge.
• Routing many apps behind one address. Sending /api to one service and /app to another.
• Compression and optimisation. Compressing responses before sending them to visitors.

A Working NGINX Reverse Proxy Example

NGINX is a common reverse proxy. The core directive is proxy_pass, and proxy_set_header controls which headers reach the upstream server, as the NGINX reverse proxy guide shows. A minimal configuration that forwards a site to an application on port 8000:

server {
    listen 80;
    server_name www.example.com;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8000;
    }
}

The X-Forwarded-For header carries the original visitor's IP address, which matters because the application otherwise only sees the proxy's address. MDN lists Forwarded, X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto as the headers used to preserve client information through proxies.

Common Reverse Proxy Software

NGINX, HAProxy, Caddy and Traefik are widely used self-hosted options, and content delivery networks run reverse proxies at global scale in front of customers' sites. Which to choose depends on your stack: NGINX and HAProxy are mature general-purpose choices, Caddy is known for automatic HTTPS, and Traefik integrates with container orchestration.

Pitfalls to Avoid

• Trusting forwarded headers blindly. Anyone can send X-Forwarded-For. Only trust it from your own proxy.
• Caching dynamic or personalised content. Make sure responses with user data are not cached and served to others.
• Losing the client IP. Without forwarded headers, logs and rate limits see only the proxy.
• Single point of failure. A single proxy instance becomes a bottleneck; run redundant instances.
• Misconfigured timeouts. Mismatched timeouts cause 502 and 504 errors; see proxy error codes.

Do You Need a Reverse Proxy?

You likely do if you run more than one server or service behind one domain, need HTTPS handled in one place, want caching or rate limiting at the edge, or want to keep origin servers off the public internet. A single small site on one server can often do without one, although a reverse proxy or CDN is still a common first step for security.

Reverse Proxy vs Load Balancer, API Gateway and CDN

These terms overlap, and one product often does several jobs. The distinction is mainly about the job rather than the software:

TLS Termination, Health Checks and Failover

Three features account for much of a reverse proxy's value in production. TLS termination means the proxy holds the certificate and decrypts HTTPS, so internal servers can speak plain HTTP on a trusted network and certificates are managed in one place. Health checks let the proxy probe each backend and stop sending traffic to one that is failing. Failover keeps the site up by routing around a failed server automatically. When a proxy cannot reach a backend you will typically see 502 or 504 responses, the same codes explained in our proxy error codes guide.

Security Benefits and Limits

A reverse proxy shrinks your attack surface by keeping origin addresses private, giving you one place to enforce rate limits, request-size limits and security headers, and letting you filter known-bad traffic before it reaches the application. It is not a substitute for fixing application vulnerabilities: a request that passes through the proxy can still exploit a flaw in the code behind it. Treat it as one layer in a defence-in-depth setup.

Frequently Asked Questions

Q: What is a reverse proxy in simple terms?
A server in front of your website's servers. Visitors talk to it, and it passes their requests to the real servers and returns the answers.

Q: What is the difference between a proxy and a reverse proxy?
A forward proxy acts for the client and hides the client from websites. A reverse proxy acts for the server and hides the origin servers from visitors.

Q: Is a reverse proxy the same as a load balancer?
Not exactly. Load balancing is one of the things a reverse proxy can do. Many reverse proxies also cache, terminate TLS and filter traffic, and a dedicated load balancer may only distribute requests.

Q: Is NGINX a reverse proxy?
NGINX is a web server that is very widely used as a reverse proxy through its proxy_pass directive.

Q: Can I use a reverse proxy for web scraping?
No. Scraping needs a forward proxy that sends your requests from different IP addresses. A reverse proxy protects your own servers. For scraping, see proxies for web scraping.

Summary

A reverse proxy sits in front of your servers, forwarding visitors' requests to them and returning the responses, which gives you load balancing, caching, TLS termination and protection for your origin. It is the mirror image of the forward proxies used for privacy and data collection, which are the kind BuyProxy sells.

Looking for forward proxies? Compare BuyProxy's proxy types →