Every self-hosted service is born with an ugly address — an IP and a port number nobody can remember. A reverse proxy is the receptionist that gives each one a proper name and a single front door.
Before the settings, the idea — because once the idea is clear, every Nginx Proxy Manager screen suddenly makes sense. A reverse proxy sits between the internet and your services. People outside knock on one door — your server on ports 80 and 443 — and the proxy reads the name they asked for and quietly passes each visitor to the right room inside. This page explains that flow slowly, and why it beats the old way of opening a separate port for every service.
Run three services at home or in a small office — a photo app, a file manager, a dashboard — and you get three addresses like 192.168.1.50:2283, each needing its own open router port and none of them with HTTPS. Nobody remembers them, nobody trusts them, and every open port is a separate door a scanner can knock on. This is the mess a reverse proxy cleans up: the services keep their internal addresses, but the outside world only ever sees clean names — photos.yourdomain.com, files.yourdomain.com — all through the same two standard ports.
The word proxy is used for two opposite directions, and mixing them up causes real confusion. A forward proxy stands in front of users — an office sends its staff's browsing through one machine. A reverse proxy stands in front of servers — the world sends requests to one machine, which distributes them to the real services behind it. Nginx Proxy Manager is the second kind. You are not hiding your browsing; you are organising your doorways.
Fewer open ports means fewer things exposed to constant internet scanning. Your internal services stop listening to the whole world and only answer the proxy on your own network. The proxy also becomes the one place where you can add protection for everything at once — access lists, basic authentication on a private app, blocking of common exploit patterns. Honestly graded, it is not a firewall and it does not make a badly built app safe. But one guarded door is a far better design than eight unguarded ones.
Raw nginx has done this job for years, configured by editing text files. Nginx Proxy Manager is that same nginx engine with a web panel on top — you fill a form instead of writing a server block, and it manages the free Let's Encrypt certificates for you. That is the entire trick, and it is a good one: the power is proven software, the learning curve is a form. The later guides in this series cover the form field by field, the certificates, and the honest limits of the panel compared with raw config files.
See the idea working live — services going online one by one behind a single door — in the full install video.
▶️ Watch Full VideoNot strictly — internal addresses work on your own LAN. The proxy earns its place the moment you want clean names, HTTPS, or safe access from outside. Many people install it for the names alone.
The extra hop is on your own network and costs a millisecond or less. For normal apps — dashboards, photo libraries, file tools — nobody can feel it. It is not the bottleneck; your internet upload speed is.
Yes. Dozens of names, including different top-level domains, can point at one NPM instance. It separates them purely by the name in each request, which is exactly what the proxy host list is.