An Apache reverse proxy does not need ProxyRequests On. That directive enables forward proxying, and leaving it on without access control makes your server an open proxy for anyone. Keep it Off, which is the default, and use ProxyPass for the backend you actually mean to expose.
The directive people confuse
The Apache mod_proxy documentation states that ProxyRequests defaults to Off and that setting it to Off does not disable ProxyPass. It also says it is not necessary to turn ProxyRequests on to configure a reverse proxy. The warning is blunt: do not enable proxying with ProxyRequests until you have secured your server, because open proxy servers are dangerous both to your network and to the Internet at large.
Old tutorials sometimes set ProxyRequests On next to a ProxyPass line. That is the mistake.
ProxyRequests Off
ProxyPass "/app/" "http://backend.internal:8080/"
ProxyPassReverse "/app/" "http://backend.internal:8080/"
What an open proxy costs you
A forward proxy that accepts any destination lets outsiders route traffic through your address. Attackers use that to hide, to scan, and to reach internal addresses. If a forward proxy is truly needed, the docs show access control inside a Proxy block, such as requiring a named internal host, and warn that matching in Proxy does not canonicalize the string. Deny by default and allow only what you expect.
ProxyPass and ProxyPassReverse
ProxyPass maps a path to a backend and rewrites requests only. ProxyPassReverse adjusts the URL in Location, Content-Location and URI response headers so that redirects from the backend stay behind the proxy. It does not rewrite absolute URLs inside HTML bodies unless you add mod_proxy_html. If the first argument ends in a slash, the second should too. A mismatch is a common source of broken or surprising routing, so test paths with and without a trailing slash.
Host and forwarded headers
ProxyPreserveHost defaults to Off. When On, the incoming Host line goes to the backend instead of the backend name. The docs say it should normally be off and is mostly useful for proxied mass name based virtual hosting. If you turn it on, make sure the backend validates Host.
ProxyAddHeaders defaults to On (since 2.3.10). It sends X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server to the backend. If the incoming request already carried those headers, the values are comma separated and may hold several entries, so a backend that reads the first value is reading client input. Read from the right, or terminate the chain at the proxy.
Quick audit
- grep the config for
ProxyRequests On. Remove it unless you run a controlled forward proxy. - Check every ProxyPass has a matching ProxyPassReverse.
- Test from outside with a request for an arbitrary external URL through the server. It should fail.
- Check what your backend does with Host and X-Forwarded-For.
curl -s -o /dev/null -w '%{http_code}\n' -x https://proxy.example.com:443 http://example.org/
You want an error or refusal, not a 200 from example.org.
Where Safeguard fits
Safeguard focuses on the software behind your proxy: dependency scanning, SBOMs, policy gates and a free scan at https://gold.safeguard.sh/scan. It does not edit Apache configuration.
Quick check
Does a reverse proxy need ProxyRequests On?
No. The Apache docs say it is not necessary, and ProxyPass works with it Off.
What does ProxyPassReverse change?
It rewrites Location, Content-Location and URI response headers so backend redirects stay behind the proxy.
Sources
Last reviewed: 19 October 2026.
