Nginx

Nginx is the gatehouse every request passes before reaching your application: it terminates encryption, serves static files, caches what can be cached, adds security headers, throttles an over-insistent visitor and spreads traffic across instances. It's the least visible brick in a hosting setup, and the one whose tuning has the most direct effect on what a visitor experiences as speed — and on what an attacker finds open.

• →CaddyAutomatic encryption and a very short configuration: fewer settings, less attention to give
• →TraefikWhen services run in containers and routing must follow them as they start and stopView page
• →CloudflareFiltering and caching at the network edge, upstream of and complementary to the local proxyView page
• →ApacheStill relevant on legacy hosting where per-directory configuration is in use

1. 01

   Configuration versioned and deployed through automation, never edited by hand on the server

2. 02

   Modern encryption only, certificates renewed automatically, systematic redirection

3. 03

   Security headers set at the proxy — the only place where they apply to everything that passes

4. 04

   Cache and compression tuned per content type, with an explicit purge rule

5. 05

   Rate limiting on authentication endpoints, and logs usable by detection tooling

• Nginx or Caddy?

  Caddy obtains and renews certificates on its own, with a far shorter configuration: for a small scope or a team with no operator, it's an excellent choice. Nginx asks for a little more writing but remains the reference for fine tuning — caching, rate limiting, load balancing — and it's what you'll find documented everywhere. Both are defensible; what isn't is leaving the application exposed with neither.
• Does Cloudflare in front make the reverse proxy pointless?

  No, they work at two levels. Cloudflare filters and caches at the network edge, before traffic reaches your hosting. Nginx decides what happens once it arrives: which service answers, which headers are set, which limits apply. And the day the edge service is bypassed or switched off, the local proxy is the last door standing.
• What does it cost?

  The software is free and open source, and it runs on the machine you already have: it adds no running cost. A commercial offering exists for advanced balancing and monitoring features, but it doesn't address SMB needs.
• What does overhauling this layer cost?

  What drives it is the number of domains and services served, the state of the existing configuration, whether deployment is automated, and the level aimed for — hardening encryption and headers is nothing like reworking caching and load balancing. The amount is set in the quote, after a free initial scoping session that puts the scope in writing before any commitment.
• Can tuning the cache break the site?

  Yes, and it's the main risk at this layer: a personalised page served from cache to another visitor is a confidentiality incident, not a performance problem. That's why caching is set content type by content type, with a written purge rule and a check on authenticated pages before anything goes live.