Why it matters
The reverse proxy handles HTTPS, routing, and the public face of the service so the underlying gateway can stay private and simple.
Checklist
- Bind OpenClaw to localhost
- Expose only 80/443 publicly
- Terminate TLS at Caddy or Nginx
- Confirm headers and upstream target are correct
Mistakes to avoid
- Leaving the raw gateway port public
- Skipping HTTP to HTTPS redirects
- Assuming local bind and public bind are the same thing
Next step
Once the proxy is in place, finish with firewall and service hardening.
Frequently asked questions
Does OpenClaw need a reverse proxy?
For a clean public deployment, yes. It gives you HTTPS and keeps the gateway off a raw public port.
Should OpenClaw bind to localhost?
Yes. The safest default is to keep the service local and expose it through the proxy.
What should I verify after proxy setup?
Check HTTPS, redirects, upstream target, headers, and that the raw gateway port is not public.
Next practical step.
Use this page as a decision shortcut, then move into the related implementation guide or checklist instead of stopping at theory.