What Is a Reverse Proxy?

Quick answer
A reverse proxy is a server that receives requests on your domain and forwards them to your app’s internal address.
It is the standard way to expose an app that listens on a private port or localhost.
It also terminates TLS, compresses responses, caches, and logs every request in one place.

What does a reverse proxy actually do?

It accepts a request on a public port, usually 443, then forwards it to the upstream server your app runs on — typically an internal address like localhost:3000. The app never talks to the internet directly. The proxy terminates TLS, so your app can speak plain HTTP internally, and it can add headers, enforce timeouts, rate-limit, and log requests without changing your app code.

Why does my app need one?

An app that binds to port 3000 is only reachable if you open that port in your firewall — which exposes it without TLS, logging, or protection. A reverse proxy gives you a single public entry point with automatic HTTPS and a place to put security headers, compression, and rate limiting. This is exactly what managed platforms like Netlify and Vercel run for you; you need to run one yourself the moment you host your own server.

What’s the difference between a reverse proxy and a load balancer?

A load balancer is a reverse proxy that distributes requests across multiple upstream servers. Every load balancer is a reverse proxy, but not every reverse proxy is a load balancer: with a single app instance you want the proxy features (TLS, headers, logging) and none of the balancing.

Where this bites vibecoders
A vibecoder who deploys with a platform gets a managed reverse proxy for free and never sees it. The moment you run your own VPS or cloud VM, the AI assistant will usually tell you to run the app on port 3000 and “just open the port” — which skips TLS, logging, and security headers entirely. Adding nginx or Caddy is the missing step between ‘it works on localhost’ and ‘it is safe on the internet’.

Where AI coding assistants get this wrong

Suggesting you open the app port directly in the firewall instead of putting a reverse proxy in front of it.
Writing proxy configs with no certificate handling, so the site serves plain HTTP.
Forwarding without upstream timeouts, so a hung backend holds connections open forever.
Omitting the X-Forwarded-For header, which breaks IP-based rate limiting and logging.

Checklist

Put a reverse proxy in front of every app you host yourself.
Terminate TLS at the proxy with a certificate that auto-renews.
Set an upstream timeout and a reasonable request size limit.
Forward X-Forwarded-For and X-Forwarded-Proto correctly.

FAQ

Do I need a reverse proxy if I use Netlify or Vercel?

No — those platforms run a managed reverse proxy in front of your site, which is why HTTPS and caching work with zero configuration. You only need to run one yourself when you host your own server or VM.

What is the easiest reverse proxy to set up?

Caddy is the most beginner-friendly because it obtains and renews TLS certificates automatically. Nginx is more common and more configurable, but you configure certificates yourself, typically with certbot.