Reverse Proxy

A reverse proxy is a server that stands in front of one or more web servers and receives every incoming request for them. Visitors connect to the reverse proxy; the reverse proxy decides which backend server should handle the request, fetches the answer, and returns it. Nobody outside ever talks to the real servers directly.

Picture the reception desk of a large office. Every visitor speaks to the receptionist, who works out who they actually need and sends the request through. Visitors never wander the building, never learn the floor plan, and never find out how many people work there.

Forward proxy vs reverse proxy — the difference that matters

This is the single most common point of confusion, and it comes down to who the proxy is working for:

• A forward proxy works on behalf of the client. You configure it, and it hides you from the websites you visit. This is the everyday proxy used for scraping and privacy.
• A reverse proxy works on behalf of the server. The site owner configures it, and it hides the servers from the people visiting them.

Same idea, opposite ends of the connection. As a visitor you cannot opt out of a reverse proxy and you generally never notice it — you have almost certainly used one today without knowing.

What it does once traffic arrives

• Load balancing — spreads requests across several backend servers so no single machine is overwhelmed, and skips any server that stops responding.
• TLS/SSL termination — handles the HTTPS encryption in one place, so each backend does not have to manage certificates itself.
• Caching — keeps copies of pages and assets, serving repeat requests instantly without troubling the application.
• Security — filters malicious requests, absorbs DDoS traffic, and enforces rate limits before anything reaches your application.
• Routing — sends /api to one service and /blog to another, so several applications can live behind a single domain.
• Compression and optimisation — shrinks responses on the way out to speed up page loads.

Why hiding the backend matters

Because visitors only ever see the reverse proxy, your real server addresses stay private. An attacker cannot target a machine whose IP they cannot discover, and you can move, replace, or add backend servers at any time without a single visitor noticing. It also means the origin can sit on a private network with no public internet exposure at all.

Reverse proxy or load balancer?

The roles overlap, which is why the terms get muddled. A load balancer's job is specifically to distribute traffic across servers. A reverse proxy does that too, but also caches, terminates TLS, rewrites requests, and filters traffic. In practice most modern reverse proxies act as load balancers, so the distinction is more about emphasis than architecture.