self hosting
N8N Reverse Proxy Setup
When n8n runs behind a reverse proxy, configure the public host, protocol, and webhook base URL so editor links and incoming webhook URLs match the external domain.
Independent third-party notes. n8n is a trademark of its owner and is referenced only for compatibility and troubleshooting context.
Quick Answer
When n8n runs behind a reverse proxy, configure the public host, protocol, and webhook base URL so editor links and incoming webhook URLs match the external domain.
Key Facts
- Public webhook base
- WEBHOOK_URL sets the public base URL used for generated webhook URLs.
- Host variable
- N8N_HOST controls the host name n8n uses.
- Protocol variable
- N8N_PROTOCOL helps align generated URLs with HTTP or HTTPS.
- Proxy risk
- Internal container URLs can leak into webhook URLs if endpoint variables are wrong.
Recommended Steps
- Point the public domain to the reverse proxy.
- Proxy traffic to the internal n8n service and port.
- Set N8N_HOST to the public host name.
- Set N8N_PROTOCOL=https when public access uses HTTPS.
- Set WEBHOOK_URL to the full public base URL.
- Generate a webhook URL and confirm it uses the public domain.
Verification
- The editor loads on the public domain.
- Generated webhook URLs use HTTPS and the public domain.
- An external request reaches a Webhook node.
Warnings
- If WEBHOOK_URL is wrong, third-party services may receive unusable webhook URLs.
- Forwarded headers and HTTPS termination should be handled consistently by the proxy.
Best For
- Self-hosted n8n behind Nginx, Caddy, Traefik, Cloudflare Tunnel, or a platform proxy.
- Public domains where the browser and external webhook providers must use the same HTTPS host.
- Deployments where n8n runs on an internal container port but should appear on a clean public URL.
Not For
- Local-only testing with no external webhook providers.
- n8n Cloud users who do not control the proxy layer.
- Cases where the real issue is a Webhook node path or workflow activation problem.
Common Mistakes
- Proxying the UI but forgetting that webhook URLs also need the public domain.
- Leaving WEBHOOK_URL unset so generated URLs use an internal host.
- Terminating HTTPS at the proxy but letting n8n generate http:// URLs.
- Not forwarding large request bodies or long-running webhook responses correctly.
Examples
N8N_HOST=automation.example.com
N8N_PROTOCOL=https
WEBHOOK_URL=https://automation.example.com/Open UI: https://automation.example.com
Copy production webhook URL from n8n
Send external curl request
Check execution history
Confirm generated URL does not contain localhostFAQ
Why does the UI work but webhooks fail?
The proxy may route browser traffic correctly while n8n still generates webhook URLs with the wrong base URL, or the proxy may not forward webhook paths correctly.
Should WEBHOOK_URL include a path?
Usually it should be the public base URL for the instance. Match the official endpoint variable docs and your proxy path strategy.
Can I run n8n under a subpath?
Subpath deployments need extra care because generated URLs, proxy rewriting, and webhook paths must all agree.