Tools · SPBoucher
Menu

Caddy

In-depth entry

by Caddy project (sponsored by ZeroSSL) · Application · also known as Caddy Server, Caddy 2

Go web server and reverse proxy that obtains and renews TLS certificates automatically and is configured with a short Caddyfile or a JSON API

Apache-2.0 licenseOpen sourceFreeSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Caddy is an open-source web server and reverse proxy written in Go and released under Apache-2.0. Its defining trait is automatic HTTPS: for every host it serves, Caddy requests a certificate through ACME from Let's Encrypt or ZeroSSL, renews it before expiry, redirects HTTP to HTTPS and keeps a sane TLS configuration without the operator touching a cipher list. Internal and wildcard certificates, DNS-challenge plugins and on-demand issuance for arbitrary hostnames are handled in the same way.

Configuration comes in two forms. The Caddyfile is a compact text format where a site block with a reverse_proxy line is enough to publish a local service, and file_server, encode, basic_auth and handle_path cover common needs. Underneath, Caddy runs on a JSON configuration that can be loaded and changed at runtime through its admin API, which makes it suitable as a programmable edge for platforms that add and remove routes dynamically. Additional modules, from DNS providers to rate limiting, are compiled in with the xcaddy tool rather than loaded at runtime.

Caddy is widely used in front of applications on single servers and small clusters, where its defaults remove most TLS and proxy boilerplate. Its limitations follow from the design: custom builds are needed for plugins, HTTP/3 support depends on the quic-go stack, and very high-throughput or feature-specific deployments may still prefer NGINX's mature module set. The project is maintained by Matt Holt and sponsored commercially, notably by ZeroSSL.

Capabilities

  • Automatic certificate issuance and renewal through ACME (Let's Encrypt, ZeroSSL) including DNS challenges and on-demand TLS
  • Reverse proxy with load balancing, health checks, header rewriting and WebSocket passthrough
  • Static file serving with compression and directory listings
  • Caddyfile text configuration and a JSON configuration loadable through a runtime admin API
  • HTTP/1.1, HTTP/2 and HTTP/3 support
  • Plugin modules compiled in with xcaddy (DNS providers, auth, rate limiting, Layer 4 proxying)

Typical workflows

  1. Publish a local web application over HTTPS with a three-line Caddyfile
  2. Act as the TLS-terminating gateway on a tunnel or VPS host and route many domains to backend nodes
  3. Add and remove routes programmatically through the admin API
  4. Serve a static site with automatic HTTPS

Strengths

  • HTTPS by default with no certificate tooling to operate
  • Short, readable configuration for common cases
  • Single static binary written in memory-safe Go
  • Runtime-reconfigurable through an API

Limitations

  • Plugins require building a custom binary with xcaddy
  • Fewer third-party modules and tuning knobs than NGINX
  • Certificate automation needs public DNS and reachable ports or a DNS-provider plugin
  • Caddyfile cannot express everything; some setups require the JSON form

Prerequisites

  • A domain whose DNS points at the server (for public certificates)
  • Ports 80/443 reachable, or DNS API credentials for the DNS challenge

Who it is for

  • Developers self-hosting web applications
  • Operators of small server fleets and homelabs
  • Platform teams needing a programmable edge

Alternatives & comparison

NGINX is the long-established reverse proxy with a broad module ecosystem but relies on external tools such as certbot for certificates. Traefik also automates ACME and discovers services from Docker or Kubernetes labels, which suits container-heavy environments better than a hand-written Caddyfile. Cloudflare Tunnel removes the need to expose ports at all by proxying through Cloudflare, at the cost of depending on that network; Caddy keeps TLS termination under the operator's control.

  • Cloudflare Tunnel

    Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports

    MixedFreemium
  • Let's Encrypt

    Nonprofit certificate authority that issues free, automatically renewable TLS certificates through the ACME protocol

    Open sourceFree
  • NGINX

    Event-driven HTTP server, reverse proxy, load balancer and mail proxy, distributed as open source under the 2-clause BSD license with a commercial Plus edition

    MixedOpen source
  • ngrok

    Hosted ingress service that exposes local servers through public URLs via an agent or SDK, with Traffic Policy rules, API gateway features and reserved domains

    ProprietaryFreemium
  • Traefik Proxy

    Cloud-native reverse proxy and ingress controller that discovers routes from Docker, Kubernetes and other providers and automates TLS through ACME

    MixedOpen source
Compare Caddy with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Let's Encrypt

Internet Security Research Group (ISRG) · DNS & domains

In-depth entry

Nonprofit certificate authority that issues free, automatically renewable TLS certificates through the ACME protocol

MPL-2.0FreeNov 2, 2026