# What Is Reverse Proxy? Definition and Examples

> A reverse proxy is a server that accepts client connections on behalf of backend servers and forwards each request to them, often terminating TLS on the way.

Source: https://ssl.sh/glossary/reverse-proxy/
Last updated: 2026-11-10

A reverse proxy accepts connections from clients on behalf of one or more backend servers and forwards each request to the right backend. Clients see only the proxy's address and certificate. nginx, HAProxy, Apache httpd, Caddy, Envoy, CDNs and cloud load balancers all commonly act as reverse proxies. It is the mirror image of a forward proxy, which acts on behalf of clients reaching out to other servers.

## Why it matters
Most HTTPS deployments perform [TLS termination](https://ssl.sh/glossary/tls-termination/) at a reverse proxy. One place holds the certificates, enforces protocol versions and [HSTS](https://ssl.sh/glossary/hsts/), redirects HTTP to HTTPS, and lets backends speak plain HTTP on a private network. The proxy must also forward what the backend can no longer see: the original Host header, the client IP and the original scheme. If `X-Forwarded-Proto` is missing, many frameworks believe the request arrived over HTTP and generate `http://` links or redirect loops. Typical certificate mistakes at the proxy are serving only the leaf certificate instead of the [full chain](https://ssl.sh/glossary/fullchain/) and pairing a certificate with the wrong private key.

## Example
```nginx
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;
    ssl_certificate     /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

## Common misconceptions
- **The backend application also needs the certificate.** Only the component that terminates TLS needs it, unless you re-encrypt to the backend.
- **The backend sees the visitor's IP address.** It sees the proxy's address unless the proxy forwards the client IP and the backend trusts that header from the proxy only.
- **A reverse proxy is the same as a forward proxy.** A forward proxy serves clients going out; a reverse proxy serves a site's visitors coming in.

## Related terms

- [TLS 终止](https://ssl.sh/zh/glossary/tls-termination/): TLS 终止是指网络路径上客户端 TLS 连接结束并被解密的位置，可以是 CDN 边缘、负载均衡、反向代理，也可以是应用服务器本身。
- [SSL 卸载](https://ssl.sh/zh/glossary/ssl-offloading/): SSL 卸载是把 TLS 握手和加解密的计算工作从应用服务器转移到专门的代理、负载均衡或硬件设备上。
- [HSTS](https://ssl.sh/zh/glossary/hsts/): HSTS 是一个 HTTP 响应头，告诉浏览器在指定时间内只通过 HTTPS 访问该站点，并且遇到证书错误时不允许用户继续访问。
- [fullchain](https://ssl.sh/zh/glossary/fullchain/): fullchain 是依次包含站点证书和中间证书的 PEM 文件，让客户端能把站点证书连到受信任的根证书。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [混合内容](https://ssl.sh/zh/glossary/mixed-content/): 混合内容是指通过 HTTPS 加载的页面中，部分脚本、图片、iframe 等子资源仍通过明文 HTTP 加载，削弱了整个页面的安全性。