Plex Behind a Reverse Proxy: The Complete Setup Guide

Running Plex behind a reverse proxy gives you HTTPS with a real certificate, a clean custom domain, and an extra layer of security. It’s also the source of some of the most confusing troubleshooting we handle.

Why Use a Reverse Proxy?

• Custom domain: Access Plex at plex.yourdomain.com instead of your-ip:32400
• Real SSL/TLS: Proper HTTPS with a Let’s Encrypt certificate
• Single entry point: One port (443) for Plex + all other services
• Security: Hide your Plex server’s real port, add rate limiting or geo-blocking
• Works behind CGNAT: With a VPS or Cloudflare Tunnel, a reverse proxy can expose Plex when your ISP won’t give you a public IP

Popular Options

Nginx Proxy Manager (recommended for beginners)

Web-based GUI for nginx. Point-and-click SSL certificates and proxy host creation. Runs in Docker.

Traefik

Auto-discovers Docker containers and creates routes via labels. More complex initial setup, but zero-touch once configured.

Caddy

Automatic HTTPS out of the box. Simple Caddyfile configuration. Great for single-service setups.

Cloudflare Tunnel

No port forwarding at all. Cloudflare’s cloudflared daemon creates an outbound tunnel. Free tier works. Downside: all traffic routes through Cloudflare, adding latency.

The Plex-Specific Gotchas

WebSocket support is mandatory

Plex uses WebSockets for real-time updates. If your proxy doesn’t pass WebSocket upgrade headers, the Plex web app shows stale data.

Custom connection URL

Tell Plex about the proxy: Settings → Network → Custom server access URLs → https://plex.yourdomain.com:443. Without this, clients may bypass the proxy.

Secure connections setting

Set Network → Secure connections to “Preferred” (not “Required”). “Required” can break local direct play.

Large file uploads

Default nginx client_max_body_size is 1MB. Plex camera upload sends multi-GB files. Set client_max_body_size 100G; or disable the limit.

Buffering through the proxy

Nginx buffers responses by default. For video streaming, disable it: proxy_buffering off; and increase timeouts. Without this, 4K streams stall.

Security Considerations

• Firewall port 32400 from external access if the proxy is on 443
• Rate limiting: Prevent brute-force attacks on the Plex login
• Fail2ban: Monitor proxy access logs for repeated 401s and auto-ban IPs
• Keep the proxy updated. nginx, Traefik, and Caddy all get security patches regularly

Need Help?

Reverse proxy configuration is one of the most common things we help with. Our remote sessions get it working correctly and securely.