Review a reverse proxy in five areas: who the client is, what is encrypted and verified, what headers and limits apply, what the proxy exposes, and how it is patched. The 15 checks below work for nginx, Apache and Caddy, with a test for each. Run them after every major config change.
Client identity
- Forwarded headers are trusted only from known hops. Send a spoofed X-Forwarded-For from outside and check the backend log. See nginx real_ip and Caddy trusted_proxies.
- Rate limits key on the real client address, not the load balancer's. Check a zone's key against the logged address.
- Limits exist for login and expensive endpoints, and test mode shows who would be blocked. See limit_conn versus limit_req.
Encryption
- Public TLS uses TLS 1.2 and 1.3 only. Test with openssl s_client. See the ssl defaults post.
- Backend hops over shared networks are encrypted and verified. Search for verification disabled, such as nginx's default off or Caddy's insecure skip option. See the termination guide.
- Certificates renew automatically and expiry is monitored from outside. See the expiry checklist.
- HTTP redirects to HTTPS and HSTS is set deliberately. See HSTS explained.
Headers and content
- Security headers are present on every status code and every location. Compare a 200 and a 404. See the add_header post.
- Personalized responses are never cached by a shared cache. Test with two accounts. See the caching post.
- Server banners are trimmed and application banners removed. Check the Server and X-Powered-By headers.
Exposure
- Unknown hosts and unknown SNI names are refused. Request the bare address. See the default server post.
- Status, metrics and admin endpoints are internal only. Request common paths from outside. See stub_status.
- No open forward proxy. Apache's ProxyRequests should be Off. See the Apache proxy post.
Operations
- Body, header and timeout limits match the app. See the limits post.
- The proxy and its modules are inventoried and patched. Parser bugs are the ones behind request smuggling.
How to run it
Keep the checks as a file in the repository, with the command and expected output for each. Run them in staging after each change and monthly in production. Record failures as tickets with owners. A WAF is a separate layer, covered in anomaly scoring, and does not replace any of the above.
Try it yourself
Open the demo and watch how a continuous check surfaces a change. Compare that rhythm with the monthly proxy review above.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard covers the last point and the software behind the proxy: asset discovery, SBOM and dependency scanning, reachability analysis, policy gates and compliance evidence automation. Run the free scan at https://gold.safeguard.sh/scan.
Quick check
Which single check finds the most common proxy mistake?
Sending a spoofed forwarded header and a request for an unknown host from outside. Both exercise trust boundaries that configs often get wrong.
Last reviewed: 19 October 2026.
