caddy

Best Practices

• Leverage automatic HTTPS — Caddy provisions and renews TLS certificates by default for public domains
• Use reverse_proxy directive with health_uri, health_interval, and health_timeout for backend monitoring
• Enable encode gzip zstd for response compression on text-based content
• Set security headers via header directive (Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy)
• Use file_server with browse disabled unless directory listing is explicitly needed
• Configure log output for structured access logging (log { output file, format json })
• Use handle and handle_path for clean mutually exclusive URL path routing
• Use domain names (not localhost) in production for automatic HTTPS provisioning
• Configure lb_policy on reverse_proxy with multiple upstreams (round_robin, least_conn, ip_hash)
• Use import directive to reuse common snippet blocks across site definitions
• Set header_up and header_down on reverse_proxy for proper request/response header manipulation
• Use respond directive for health check endpoints and static responses
• Configure request matchers (@name) for conditional directive application
• Use tls directive with on-demand TLS or custom certificate paths when automatic HTTPS is not suitable