Category:ProxyView as Markdown
What Is a Reverse Proxy? A Plain Introduction
Lead Software Engineer
Here's something that took me a long time to notice:
Almost none of the requests I've ever sent to a website reached the website.
They reached a reverse proxy. The real server was somewhere behind it, and it only heard about my request if the proxy decided it should.
That's the whole idea. A reverse proxy is a server that stands in front of other servers, answers to their name, and decides what gets through. Once you see it, a lot of the web makes more sense: why one hostname can be forty machines, why a site survives a traffic spike, and why your scraper keeps getting a 403 from something that isn't the site.
The Definition, in One Line
The HTTP spec calls a reverse proxy a gateway: an intermediary that "acts as an origin server" for the connection coming in, then forwards the request inward to another server (RFC 9110, section 3.7).
Acts as an origin server is the important part. The reverse proxy owns the hostname, holds the TLS certificate, and answers on port 443. From where you're standing, it is the website.
I checked how literally that's true by sending one plain request to a handful of big sites and reading the server header, which is the name of whatever machine answered:
| Site | What answered |
|---|---|
| discord.com | cloudflare |
| shopify.com | cloudflare |
| netflix.com | envoy |
| amazon.com | CloudFront |
| reddit.com | Varnish, then a 403 |
| scrape.do | cloudflare (yes, us too) |
Not one of them answered as itself. Every reply came from a reverse proxy, and two of them came from the proxy's cache, meaning the actual site never learned I was there.
Forward Proxy vs Reverse Proxy
If you've ever used a VPN or rented a proxy for scraping, you already know the other kind. That's a forward proxy. It sits next to you and hides your IP from the site.
A reverse proxy is the same trick pointed the other way. It sits next to the servers and hides them from you.
Same box. The difference is whose side it's on. A forward proxy is loyal to the client: you set it up, you pay for it. A reverse proxy is loyal to the server: the site's operator sets it up, and you don't get a vote.
That's also where the odd name comes from. In the 1990s "proxy" meant the box in a corporate network that every browser pointed at. When people started putting the same kind of box in front of servers, they needed a word for a proxy facing the other direction. Reverse.
What It Does to Your Request
"It forwards requests to the backend" is true and tells you nothing. The interesting part is everything the proxy does before forwarding, because each step has its own way of saying no.
In order:
- TLS termination. The proxy holds the certificate and decrypts your request. From here on it can read everything.
- Bot and WAF check. It looks at your IP's reputation, your TLS fingerprint, and your headers. Fail this and you get a 403 or a challenge page.
- Rate limiter. A counter per IP or token. Blow through it and you get a 429.
- Cache. If the proxy already has a fresh copy of the page, it answers from memory and the origin never hears about you.
- Router. Only now does it pick a real server, open a connection on the private network, and add an
X-Forwarded-Forheader so the origin knows your IP. If that server is down, the proxy writes the 502 itself.
Every one of those answers came from the proxy. The origin's only line is the 200 at the end.
That's why a reverse proxy is worth having if you run a site. One box handles certificates, blocks abuse, absorbs repeat traffic, and spreads the rest across as many servers as you need, and none of your application code has to know.
Why You Keep Running Into One
Flip the picture around. If you scrape, you're on the left side of that first diagram, and the thing refusing you is on the right.
Your forward proxy talks to their reverse proxy. That's the entire cat-and-mouse game of web scraping in one sentence. A fresh IP fixes one thing the bot check looks at and leaves the rest alone, which is why a rotating residential address with a plain Python fingerprint still gets a 403.
It's also what Scrape.do is, described plainly: a fleet of forward proxies and real browsers whose full-time job is satisfying reverse proxies. It handles the fingerprint, the challenge, and the retry, and only charges when the reverse proxy lets the request through.
Where to Go From Here
Next time a request fails, read the server header before the status code. If it says cloudflare, envoy, varnish, or CloudFront, the site never saw you. A reverse proxy did, and it said no at one of the five stops above.
That's the introduction. The systems people build these with (NGINX, Caddy, Traefik, Envoy, Cloudflare) and how to pick between them is a separate article.
Get 1000 free credits and start scraping with Scrape.do
Frequently Asked Questions
What is the difference between a proxy and a reverse proxy?
A regular proxy (a forward proxy) sits on the client's side and hides the client from the server. A reverse proxy sits on the server's side and hides the servers from the client. Same mechanism, opposite loyalty.
Is Cloudflare just a reverse proxy?
Yes. When you turn on Cloudflare's proxy for a DNS record, their servers terminate TLS, inspect and cache the request, and forward it to your origin. The firewall, bot protection, and CDN are things that reverse proxy does on the way through. W3Techs measured Cloudflare in front of 25.7% of all websites in September 2026.
Is a reverse proxy the same as a load balancer?
A load balancer is a reverse proxy with one specific job: spreading requests across identical copies of a service and skipping the copies that are down. Every load balancer is a reverse proxy. A reverse proxy with a single server behind it is still a reverse proxy. It isn't a load balancer.
Lead Software Engineer
