Reverse Proxy

A reverse proxy is a server that sits in front of one or more backend servers and forwards incoming client requests to them, then returns the response as if it came from the proxy itself. It does the opposite of a forward proxy, which sits in front of clients and forwards their requests outward.

That direction is the whole distinction. As MrScraper's guide to proxy servers puts it, forward proxies serve clients, reverse proxies serve servers. A forward proxy hides who is asking. A reverse proxy hides who is answering.

What Is a Reverse Proxy?

When you load a site running behind a reverse proxy, your request never reaches the origin server directly. It terminates at the proxy, which decides which backend should handle it, passes it along over the internal network, then relays the response back to you. Your browser isn't configured for any of this and has no way to tell the difference, from the client side, the proxy simply is the website.

Ownership is the other half of the picture. A reverse proxy is deployed and controlled by whoever runs the site, not by the person visiting it. Nginx, HAProxy, Traefik, and Cloudflare all operate in this role, and a typical nginx reverse proxy setup is a handful of proxy_pass directives routing requests to app servers running on internal ports.

Reverse Proxy vs. Forward Proxy

Both are intermediaries that relay traffic. They just stand at opposite ends of the same connection, which is why the reverse proxy vs forward proxy question resolves so cleanly once you know which side each one is protecting.

What a Reverse Proxy Is Used For

• Load balancing: spreading incoming requests across a pool of backend servers so no single machine absorbs a traffic spike alone.
• TLS termination: handling HTTPS encryption and certificates at the edge so backends can exchange plain HTTP internally.
• Caching and compression: serving stored responses and compressing assets without waking the origin server at all.
• Security and filtering: keeping origin IPs off the public internet while applying rate limits, WAF rules, and DDoS absorption at a single controlled entry point.
• Routing: presenting several separate services behind one domain, routed by path or subdomain.