Using a Reverse Proxy to Improve Performance and Security

Introduction

A reverse proxy sits in front of a website, application or origin server. Instead of visitors connecting directly to the backend application, they connect to the reverse proxy first. The reverse proxy then forwards requests to the correct internal service.

Reverse proxies are commonly used with Nginx, Apache, HAProxy, Cloudflare, CDN services, load balancers and application gateways. They can improve performance, protect backend services, terminate SSL, cache content, route traffic and reduce direct exposure of the origin server.

Quick answer

What is a reverse proxy?

A reverse proxy is a server or service that accepts requests from visitors and forwards them to one or more backend servers.

Visitor:
https://example.com

Reverse proxy:
Nginx, Cloudflare, HAProxy, load balancer or CDN

Backend:
Application server, WordPress server, API, container or VPS service

Reverse proxy vs forward proxy

A forward proxy represents the client. A reverse proxy represents the server.

Common reverse proxy types

Reverse proxies can be implemented in different ways.

Common examples:

• Nginx reverse proxy on a VPS
• Apache reverse proxy
• HAProxy load balancer
• Cloudflare proxy/CDN
• CDN edge proxy
• managed load balancer
• Kubernetes ingress controller
• application gateway
• Docker reverse proxy

Performance benefits

A reverse proxy can improve performance when configured correctly.

Performance features:

• static file caching
• CDN edge caching
• compression
• HTTP/2 or HTTP/3 support
• connection reuse
• TLS termination
• load balancing
• request buffering
• image optimization through CDN
• routing to faster backend services
• reducing repeated origin requests

Security benefits

A reverse proxy can reduce direct exposure of the origin server.

Security benefits:

• hide backend application ports
• terminate SSL at a controlled layer
• block unwanted traffic
• rate limit abusive requests
• filter common attacks
• protect origin IP where possible
• enforce HTTPS
• add security headers
• restrict admin paths
• separate public traffic from internal services
• centralize logging

SSL termination

SSL termination means the reverse proxy handles HTTPS certificates and decrypts traffic before forwarding it to the backend.

Common setups:

• HTTPS visitor → reverse proxy → HTTP backend
• HTTPS visitor → reverse proxy → HTTPS backend
• CDN SSL at edge → HTTPS to origin
• Nginx SSL → local app on 127.0.0.1

Caching and CDN

Reverse proxies can cache static or full-page content to reduce origin load.

Can cache:

• images
• CSS
• JavaScript
• fonts
• public HTML pages
• API responses where safe
• downloads

Be careful with:

• logged-in pages
• carts and checkout
• admin pages
• personalized content
• user dashboards
• forms
• search results
• API responses with private data

Real client IP and proxy headers

When traffic passes through a reverse proxy, the backend may see the proxy IP instead of the real visitor IP.

Important headers:

• X-Forwarded-For
• X-Real-IP
• X-Forwarded-Proto
• X-Forwarded-Host
• CF-Connecting-IP for Cloudflare setups

Load balancing

A reverse proxy can distribute traffic across multiple backend servers.

Common methods:

• round robin
• least connections
• IP hash
• weighted upstreams
• health-check-based routing

Useful for:

• high traffic websites
• APIs
• multiple app servers
• failover setups
• horizontal scaling
• separating frontend and backend services

Why this matters

A misconfigured reverse proxy can also break a site. Common issues include 502 Bad Gateway, redirect loops, wrong visitor IPs, SSL mismatch, stale cache, blocked validation paths and exposed backend ports.

How to check reverse proxy setup

Use Domain Health Checker, Website Status Checker, HTTP Header Checker and SSL Checker to verify public behavior.

1. DNS — Confirm the domain points to the proxy or correct origin.
2. Website status — Confirm the final URL returns the expected status code.
3. SSL — Confirm certificate is valid for the public hostname.
4. Redirects — Check HTTP to HTTPS and www/non-www behavior.
5. Headers — Check security headers and proxy-related headers.
6. Backend availability — Confirm the origin application is running.
7. Client IP handling — Confirm logs show real visitor IP where needed.
8. Cache behavior — Confirm dynamic pages are not cached incorrectly.

Common problems

How to use a reverse proxy safely

1. Step 1: Define the traffic flow

   Decide what the public proxy receives and where it forwards traffic.

2. Step 2: Confirm DNS

   Point the domain to the proxy or correct public endpoint.

3. Step 3: Protect backend

   Keep backend services private or restrict them by firewall.

4. Step 4: Configure SSL

   Use a valid public certificate and decide whether backend also uses HTTPS.

5. Step 5: Set proxy headers

   Pass host, protocol and real client IP correctly.

6. Step 6: Configure redirects

   Choose one canonical HTTPS hostname and avoid duplicate redirect layers.

7. Step 7: Set cache rules carefully

   Cache static/public content, not private user pages.

8. Step 8: Test status and headers

   Verify HTTP status, redirects, SSL and security headers.

9. Step 9: Check logs

   Review proxy logs and backend logs during testing.

10. Step 10: Monitor continuously

    Watch origin health, proxy errors, cache behavior and SSL expiry.

Nginx reverse proxy example

server {
    listen 80;
    server_name example.com www.example.com;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

CDN reverse proxy example

Visitor:
https://example.com

CDN/proxy:
Cloudflare or another CDN

Origin:
VPS server IP

DNS:
example.com → proxied CDN record

Origin server:
Nginx/Apache listens on 80/443

Important:
- SSL mode must match origin setup
- origin must accept CDN traffic
- cache rules must exclude private pages
- real visitor IP headers must be configured

Useful reverse proxy checks

Check public status:
curl -I https://example.com

Follow redirects:
curl -IL http://example.com

Check response headers:
curl -I https://example.com

Check local backend:
curl -I http://127.0.0.1:3000

Check listening ports:
sudo ss -tulpn

Check Nginx config:
sudo nginx -t

Check Nginx errors:
sudo tail -100 /var/log/nginx/error.log

Check SSL certificate:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Reverse proxy security checklist

Frequently asked questions