Plex Reverse Proxy Setup: Caddy, nginx, Traefik (2026)

Why put Plex behind a reverse proxy?

• A domain you control, for apps where you type an address by hand, which keeps working if the long plex.direct address changes when your internet provider changes your IP. (Apps that take your server's addresses from Plex, as Media Center does, follow that change on their own.)
• Port 443 only. Hotel, office and school networks often block 32400 but never block HTTPS.
• One front door for Plex, Jellyfin, Overseerr and anything else you host, with automatic certificates.

If none of those matter to you, you do not need one. Plex Remote Access already gives you a secure address — see how to set up Plex Remote Access.

Set up a Plex reverse proxy in six steps

1. Point a domain at your homeCreate a DNS A record, such as plex.example.com, pointing at your home's public IP address. Use dynamic DNS if that IP changes.
2. Forward port 443 to the proxyIn your router, forward TCP 443 (and 80, for certificate renewal) to the machine running the reverse proxy.
3. Configure the proxyUse one of the configurations below: Caddy, nginx, Traefik, Nginx Proxy Manager or Synology. Each one terminates HTTPS and forwards to Plex on port 32400.
4. Tell Plex its new addressIn Plex Web, open Settings → Network, show the advanced settings, and enter https://plex.example.com:443 under Custom server access URLs. Save. This is how Plex apps learn to connect through your proxy.
5. Keep secure connections set to PreferredUnder Settings → Network, leave Secure connections on Preferred so the proxy can reach Plex on the local port.
6. Test from outside your homeTurn off Wi-Fi on your phone and open https://plex.example.com/web. If Plex Web loads with a padlock, the proxy works.

Plex reverse proxy with Caddy (the easiest)

Caddy obtains and renews a certificate on its own (from Let's Encrypt or ZeroSSL) and passes WebSocket connections through without extra settings. This is the whole Caddyfile:

plex.example.com {
	reverse_proxy localhost:32400
}

If Caddy runs on a different machine from Plex, replace localhost with the Plex server's LAN address, for example 192.168.1.20:32400.

Plex nginx reverse proxy config

Get a certificate with Certbot (sudo certbot certonly --nginx -d plex.example.com) and add this server block. The WebSocket headers and proxy_buffering off are what most broken Plex nginx configs are missing.

server {
    listen 443 ssl;
    http2 on;
    server_name plex.example.com;

    ssl_certificate     /etc/letsencrypt/live/plex.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/plex.example.com/privkey.pem;

    # Posters and uploads can be large.
    client_max_body_size 100M;

    location / {
        proxy_pass http://127.0.0.1:32400;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Plex uses WebSockets for live updates.
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Stream video as it arrives instead of buffering it.
        proxy_buffering off;
        proxy_read_timeout 3600s;
    }
}

On nginx older than 1.25.1, put http2 on the listen line instead of using the separate http2 on; directive.

Plex reverse proxy with Traefik

If Plex runs in Docker next to Traefik, add labels to the Plex service. This assumes a websecure entry point on 443 and a certificate resolver named letsencrypt in your Traefik configuration:

services:
  plex:
    image: plexinc/pms-docker
    # ...your existing volumes and environment...
    labels:
      - traefik.enable=true
      - traefik.http.routers.plex.rule=Host(`plex.example.com`)
      - traefik.http.routers.plex.entrypoints=websecure
      - traefik.http.routers.plex.tls.certresolver=letsencrypt
      - traefik.http.services.plex.loadbalancer.server.port=32400

Plex with Nginx Proxy Manager (NPM)

1. Hosts → Proxy Hosts → Add Proxy Host. Domain: plex.example.com; scheme http; forward hostname: the Plex server's IP; port 32400.
2. Turn on Websockets Support and Block Common Exploits.
3. On the SSL tab, request a new Let's Encrypt certificate and turn on Force SSL and HTTP/2 Support.

Plex reverse proxy on Synology

1. Get a certificate for your domain in Control Panel → Security → Certificate (Let's Encrypt is built in).
2. Open Control Panel → Login Portal → Advanced → Reverse Proxy and create a rule. Source: HTTPS, plex.example.com, port 443. Destination: HTTP, localhost, port 32400.
3. On the rule's Custom Header tab, choose Create → WebSocket to add the upgrade headers.
4. Assign the certificate to the new hostname under Security → Certificate → Settings.

Plex reverse proxy and Cloudflare: the catch

Many guides tell you to put Plex behind Cloudflare's proxy or a Cloudflare Tunnel. On an ordinary plan, don't. Cloudflare's service terms say that, unless you are an Enterprise customer, you must use its paid services — such as the Developer Platform, Images and Stream — to serve video and other large files through its CDN, and it reserves the right to limit accounts that do otherwise. A Tunnel's public hostname is served through the same network. Caching can also stall playback.

You can still use Cloudflare for DNS: set the Plex record to DNS only (the gray cloud) so viewers connect straight to your own proxy.

Troubleshooting a Plex reverse proxy

• Plex apps still use plex.direct. Check the address under Custom server access URLs includes https:// and :443, then sign out and back in on the app.
• Plex Web loads but never updates or plays. WebSocket headers are missing — add them (nginx), or turn on Websockets Support (NPM) or the WebSocket custom header (Synology).
• Video stutters only through the proxy. Turn off buffering in the proxy and make sure a CDN is not proxying the traffic.
• Certificate errors. The domain must resolve to your public IP and port 80 must reach the proxy when the certificate is issued or renewed.
• It works at home but not outside. Work through Plex remote access not working; a double NAT or CGNAT blocks a proxy the same way it blocks Plex.

Need a token for another third-party app? See how to find your X-Plex-Token. Running Jellyfin too? The same proxy works — see Jellyfin HTTPS setup.