Best Self-Hosted Reverse Proxy Tools

A reverse proxy is the front door of a self-hosted stack: one process on ports 80 and 443 that sorts requests by hostname, terminates TLS, and hands each one to the right app. All four picks here get you valid Let's Encrypt certificates, so choose by how you want to describe your routes. Caddy reads them from a short Caddyfile and handles HTTPS with no extra step; Traefik builds them from Docker container labels as services come and go; Nginx Proxy Manager and Zoraxy are web UIs where every route is a form — Nginx Proxy Manager the simplest, Zoraxy adding country blocklists, load balancing, an uptime monitor and a web SSH terminal. Decide between a file, labels and a form first; everything else follows.

Reverse proxy

Caddy

A web server and reverse proxy with automatic HTTPS on by default: name a domain in a two-line Caddyfile and it obtains and renews the certificate from Let's Encrypt or ZeroSSL and redirects HTTP to HTTPS for you. A single Apache-2.0 Go binary with no external dependencies, HTTP/3 on by default, and a JSON admin API for zero-downtime config changes — no web UI and no container auto-discovery out of the box.

Go

easyRead guide →

Reverse proxy

Nginx Proxy Manager

Put your self-hosted apps behind clean domains with automatic Let's Encrypt TLS — all from a point-and-click web UI. The fastest way to get HTTPS on a home server without touching a config file.

Node.jsNginx

easyRead guide →

Reverse proxy

Traefik

A cloud-native reverse proxy that auto-discovers your Docker containers via labels and provisions TLS for them automatically. More setup than a UI proxy, but unbeatable once your stack grows.

Go

moderateRead guide →

Reverse proxy

Zoraxy

A general-purpose reverse proxy managed entirely from a web UI, built for homelabs: proxy rules with load balancing and basic auth, redirection rules, ACME certificates with auto-renew and DNS challenges, TCP/UDP stream proxying, country and IP allow/deny lists, plus an uptime monitor, web SSH terminal and network utilities in the same AGPL-3.0 Go binary. The admin UI listens on port 8000 and asks you to create the single admin account on first visit.

Go

easyRead guide →

Head-to-heads in this category

ProxySep 2026

Caddy

vs

Nginx Proxy Manager

Automatic HTTPS from a two-line file vs. from a web form.

Read the verdict →

ProxySep 2026

Caddy

vs

Traefik

A two-line Caddyfile vs. routes that follow your container labels.

Read the verdict →

ProxySep 2026

Nginx Proxy Manager

vs

Traefik

Point-and-click HTTPS vs. auto-configuring proxy.

Read the verdict →