Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The reliable way to enable HTTPS for Uptime Kuma is to put Kuma behind a reverse proxy or a Cloudflare Tunnel. The proxy (or tunnel) owns your public hostname and TLS certificate, while Uptime Kuma continues listening on its normal internal HTTP port, usually 3001. Forward ordinary HTTP requests and WebSocket upgrades to Kuma, test from outside your network, and keep port 3001 private whenever the proxy is the only public entry point.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Do not publish Kuma at a normal path such as example.com/uptimekuma: the official documentation says that deployment pattern is not supported. Use a dedicated hostname such as status.example.com or a subdomain instead. The official Uptime Kuma reverse-proxy guide also warns that Kuma is WebSocket-based, so a proxy that handles only ordinary HTTP will produce a partially broken dashboard.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the HTTPS setup looks like
Uptime Kuma itself normally serves HTTP on port 3001. HTTPS is terminated in front of it:
- A DNS record points a hostname such as
status.example.comto your server, proxy, or tunnel. - Caddy, Nginx, Apache, Traefik, or Cloudflare Tunnel obtains or presents the TLS certificate for that hostname.
- The proxy forwards requests to
http://127.0.0.1:3001(or the Kuma container’s address). - WebSocket upgrade requests are forwarded as well, allowing live dashboard updates, login state, and notifications to continue working.
Users connect to https://status.example.com; Kuma can remain an internal HTTP service. The official wiki recommends SSL with a web server to reduce man-in-the-middle risk on public networks. It states: “Unlike other web apps, Uptime Kuma is based on WebSocket.” It also states: “It is recommended to use SSL (HTTPS) with your web-server to avoid MiTM attacks when on a public network.” Those statements appear in the official reverse-proxy documentation, edited April 24, 2026.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Before you configure anything
Choose a hostname, not a subdirectory
Create a DNS A or AAAA record for a dedicated name. A subdomain is the least surprising arrangement because Kuma generates links and WebSocket connections for the host it is served from. A regular subdirectory deployment, for example example.com/uptimekuma, is not supported by the official guide.
Decide where TLS will terminate
Use one of these patterns:
- Native reverse proxy: Caddy, Nginx, Apache, or Traefik listens on ports 80 and/or 443 and forwards to Kuma.
- Cloudflare Tunnel: the tunnel publishes the hostname and supplies HTTPS without a separate Nginx, Caddy, or Traefik instance.
Do not run multiple independent TLS terminators for the same hostname unless you deliberately understand which one receives traffic first.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep Kuma’s listener private where possible
If the proxy is the only intended public entry point, bind or firewall port 3001 so it is reachable only from the proxy or local host. This prevents users from bypassing HTTPS by visiting the server’s IP address and port directly. For containers, place Kuma and the proxy on the same private network and publish only the proxy’s public ports.
Which HTTPS method should you choose?
| Method | Certificate automation | Separate proxy required? | Docker integration | WebSocket handling | Can port 3001 stay private? |
|---|---|---|---|---|---|
| Caddy | Automatic acquisition and renewal when DNS and ports 80/443 are correctly configured | No additional proxy beyond Caddy | Use a shared proxy network and Caddy labels in the documented pattern | Handled by reverse_proxy |
Yes |
| Nginx | Certbot with Let’s Encrypt can populate the configuration and set renewal and HTTP-to-HTTPS redirection | Nginx is the proxy | Works with a published or private Kuma container, depending on your network design | Requires HTTP/1.1 plus Upgrade and Connection headers | Yes |
| Apache | Certbot can manage the certificate lifecycle | Apache is the proxy | Works when Apache can reach the Kuma container | Rewrite WebSocket upgrades to ws://localhost:3001 |
Yes |
| Traefik | Configured certificate resolver automates issuance and renewal | Traefik is the proxy | Docker labels are the normal integration | Traefik forwards the WebSocket connection through the labeled service | Yes |
| Cloudflare Tunnel | Zero-configuration SSL supplied by the tunnel | No separate Nginx, Caddy, or Traefik required | Provide a tunnel token in the documented Docker setup | The tunnel carries Kuma’s WebSocket traffic | Yes; no inbound 3001 exposure is needed |
The right choice is usually the component you already operate. Caddy has the shortest native configuration; Nginx and Apache suit existing web-server installations; Traefik is convenient when Docker labels already drive your routing; and Cloudflare Tunnel is useful when you do not want to open inbound web ports.
Recommended deployment sequence
- Choose the hostname. Use a dedicated domain or subdomain and point DNS at the reverse proxy or tunnel endpoint.
- Run Kuma internally. Leave Kuma on its normal service port, normally 3001, and restrict that port to the local machine or private container network.
- Configure the front end. Add the Caddy, Nginx, Apache, Traefik, or tunnel configuration for the hostname.
- Issue the certificate. Use Caddy or Traefik automation, Certbot with Let’s Encrypt, or the tunnel’s managed SSL.
- Preserve WebSockets. Confirm the proxy sends the Upgrade and Connection headers or otherwise supports WebSocket pass-through.
- Test the public URL. Open the HTTPS hostname from an external network, sign in, watch a monitor update, and trigger a notification.
- Set proxy trust only when appropriate. In Kuma, enable Trust Proxy only after the service is fully behind a controlled proxy and forwarded headers cannot be supplied by untrusted clients.
Option A: Caddy
Caddy is the shortest configuration when it is installed directly on the host. The official example is:
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
subdomain.domain.com {
reverse_proxy 127.0.0.1:3001
}Replace subdomain.domain.com with your real hostname. Caddy requests and renews the certificate automatically when the hostname resolves to the server and ports 80 and 443 are reachable as required by its certificate flow. The proxy then forwards both normal requests and WebSocket traffic to Kuma.
Recommended Free Tools
Native Caddy checklist
- Create the DNS record before starting certificate issuance.
- Allow the required public web ports through the host firewall and any upstream firewall.
- Reload Caddy after saving the site block.
- Browse to the HTTPS hostname and verify that the certificate name matches the hostname, not an IP address.
- After the page loads, open the browser developer tools or simply observe whether the dashboard updates without a manual refresh.
Docker pattern
The official Docker Compose pattern puts Uptime Kuma on the same proxy network as Caddy and uses labels, including caddy.reverse_proxy: "* {{upstreams 3001}}". The important details are that Caddy can resolve the Kuma container and that the service’s internal port is 3001. Do not publish 3001 to the entire internet merely because Caddy is containerized.
Option B: Nginx
For Nginx, create an SSL-enabled server block for the hostname. The documented pattern is:
server {
listen 443 ssl http2;
server_name sub.domain.com;
ssl_certificate /path/to/ssl/cert/crt;
ssl_certificate_key /path/to/ssl/key/key;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass http://localhost:3001/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}Replace the hostname and certificate paths. The Host header lets Kuma know which public host the request used; the client-IP headers preserve the address supplied by the proxy; and HTTP/1.1 with the Upgrade and Connection headers enables WebSockets.
Obtaining certificates with Certbot
The official Nginx instructions start with the “Without SSL” settings and then use Certbot with Let’s Encrypt. Certbot can populate the Nginx configuration, create an automatic HTTP-to-HTTPS redirect, and arrange renewal. Confirm that the resulting server block still contains the WebSocket directives after Certbot changes it. A certificate that is valid but paired with a proxy block missing WebSocket forwarding will still leave Kuma malfunctioning.
Rank #3
- Not including the Raspberry Pi 5 (8GB), the Crowpi advanced version comes with the Raspberry Pi 5
- ELECROW Black Case for the Raspberry Pi 5, CrowPi is equipped with a 9-inch HD touchscreen along with a camera; All the regular components used in DIY electronics are packed into the CrowPi development board, such as LCD, LED matrix, buzzer, light sensor, PIR sensor, ultrasonic sensor, IR sensor, etc
- Raspberry Pi Sensors: The Crowpi raspberry pi 5 programming kit is jam-packed with lots of buttons such as 19 different sensors in a tidy easy to use package; You don't have to wait and wire things
- Build Quality: Solid ABS shell and well made components in one place make it strong and convenient to travel
- Programming Lessons: This raspberry pi 5 learning kit ships with step by step instructions and provides 21 lessons to take you through identifying components reading code and running it in the terminal
Nginx-specific checks
- Ensure the 443 server block has the hostname you actually use.
- Check that the certificate and key are readable by Nginx.
- Keep the trailing slash in
proxy_pass http://localhost:3001/;as shown unless you have a tested reason to change URI handling. - Use a separate HTTP listener only for redirecting port 80 to HTTPS if you want all visits encrypted.
Option C: Apache
Apache uses an SSL virtual host on port 443 with SSLEngine On, SSLCertificateFile, and SSLCertificateKeyFile. Proxy ordinary requests to http://localhost:3001/ and route WebSocket upgrades to ws://localhost:3001/ using the rewrite rules in the official wiki example.
Apache configuration principles
- Enable the SSL, proxy, proxy-http, rewrite, and WebSocket-related modules required by your distribution.
- Set the public hostname in the virtual host and preserve the incoming Host header.
- Use the SSL certificate and key issued for that hostname.
- Keep the WebSocket rewrite ahead of the ordinary HTTP proxy rule so an upgrade is not treated as a normal page request.
Certbot can manage Apache certificates and their renewal. After any automated change, test both the dashboard and a live WebSocket connection rather than checking only that the padlock appears.
Option D: Traefik
The official Traefik Docker labels define four essential pieces: a router rule for your hostname, an HTTPS entrypoint, tls=true, and a certificate resolver. The service label points Traefik to Kuma’s internal port 3001. Replace the example hostname and resolver name with values from your Traefik installation.
Traefik deployment checks
- The Kuma container and Traefik must share a Docker network.
- The router must listen on the HTTPS entrypoint, not only the HTTP entrypoint.
- The TLS resolver must be configured in Traefik before the label references it.
- The service port must be 3001, even if the container is not published on the host.
Traefik handles the WebSocket connection as part of its HTTP proxying, so no Nginx-style manual Upgrade header block is normally required. A failed resolver, wrong network, or incorrect service port will prevent routing before Kuma receives any request.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOption E: Cloudflare Tunnel
Cloudflare Tunnel is an alternative when you want a public HTTPS hostname without exposing inbound ports or maintaining a separate reverse proxy. The official Cloudflare Tunnel instructions for Uptime Kuma describe zero-config SSL and two installation paths:
Rank #4
- Fully assembled for plug-and-play operation
- Includes Raspberry Pi 5 with 8GB RAM
- 256 GB PCIe Pi NVMe SSD (Pre-loaded with Pi 64-Bit OS)
- M.2 HAT+
- CanaKit Turbine Black Case for the Pi 5
- Docker: provide the tunnel token in the documented container settings, then configure the tunnel hostname to reach Kuma’s internal service.
- Non-Docker: install
cloudflaredon the host and create the tunnel route to Kuma.
The tunnel replaces the separate Nginx, Caddy, or Traefik layer. Kuma can remain bound to a private address because the tunnel agent makes the outbound connection. You still need to verify that the tunnel route points to the correct internal port and that WebSocket traffic is allowed.
When a tunnel is preferable
- Your server is behind carrier-grade NAT or a restrictive firewall.
- You do not want to open ports 80 and 443 to the internet.
- You already manage DNS and access policies through the tunnel provider.
A tunnel does not remove the need to secure the Kuma account or the host. It changes how traffic reaches the service; it does not make an outdated host, weak password, or publicly reachable port safe.
Trust Proxy setting in Kuma
When Kuma is completely behind your reverse proxy and the native port is firewall-restricted, open Settings → Reverse Proxy → HTTP Headers and set Trust Proxy to Yes. This allows Kuma to trust controlled X-Forwarded-* headers so client IP addresses are represented correctly in logs.
Do not enable this setting while users can reach Kuma directly and supply their own forwarded headers. Trust Proxy is appropriate only when every request arrives through the proxy or tunnel you control. If you later expose port 3001 for troubleshooting, disable the setting or restore the firewall boundary before allowing untrusted traffic.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Testing HTTPS and WebSockets
Browser test
- Visit the exact HTTPS hostname, not the server IP and port 3001.
- Sign in and load the dashboard.
- Wait for a monitor interval or trigger a safe test event; the status should update without a full-page reload.
- Open and close a monitor detail view, then confirm notifications behave normally.
External-network test
Repeat the test from a phone on mobile data or another network. A test performed only from inside the LAN can hide DNS, firewall, certificate-chain, or hairpin-NAT problems.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
What a failure tells you
| Symptom | Likely cause | Action |
|---|---|---|
| Certificate warning | Hostname does not match the certificate, issuance failed, or the wrong certificate is served | Check DNS, the certificate paths or resolver, and the hostname in the proxy configuration. |
| Page loads but live status never changes | WebSocket upgrade is not reaching Kuma | For Nginx, verify HTTP/1.1 and the Upgrade and Connection headers. For Apache, verify the WebSocket rewrite. For container proxies, verify network and service labels. |
| 502 or 504 from the proxy | Proxy cannot reach port 3001 | Check that Kuma is running, listening on the expected address, and reachable from the proxy’s network. |
| Redirect loop | Conflicting HTTP-to-HTTPS redirects or incorrect forwarded-protocol handling | Keep one clear HTTPS termination point and inspect the proxy’s forwarded-protocol settings. |
| Logs show the proxy address for every visitor | Forwarded headers are not being passed or Trust Proxy is disabled | Preserve the client-IP headers and enable Trust Proxy only after the proxy boundary is enforced. |
Direct access to http://server:3001 still works publicly |
The native listener is exposed outside the private network | Remove the port publication or restrict it with a firewall; use the HTTPS hostname for all user access. |
Security and maintenance checklist
- Use a dedicated hostname and a certificate issued for that hostname.
- Keep Kuma and its operating system updated according to your normal maintenance process.
- Restrict port 3001 to localhost or the private container network when a proxy is in front.
- Preserve WebSocket forwarding; HTTPS alone does not guarantee a working Kuma dashboard.
- Use a strong Kuma administrator password and protect proxy-management credentials separately.
- Confirm certificate renewal before the first certificate approaches expiration. Caddy, Traefik, Certbot, and Cloudflare Tunnel have different renewal mechanisms, so check the component’s logs.
- Test from outside the LAN after DNS, firewall, certificate, or proxy changes.
- Enable Trust Proxy only when forwarded headers are controlled by your proxy or tunnel.
Common design mistakes to avoid
Publishing Kuma under /uptimekuma
This is not a supported normal-subdirectory deployment. Use a hostname such as status.example.com instead.
Forgetting that Kuma is WebSocket-based
A plain HTTP reverse proxy can display the initial HTML while silently breaking live updates. Treat WebSocket forwarding as a required part of the configuration, not an optional optimization.
Opening 3001 “temporarily”
Leaving the native port reachable creates a second access path that may bypass TLS and proxy controls. Close it after testing, and keep the firewall rule aligned with the final architecture.
Trusting forwarded headers too early
Trust Proxy improves client-IP accuracy only when the proxy is authoritative. If direct clients can reach Kuma, they may forge those headers.
Testing only the padlock
A valid certificate proves encryption to the proxy, not that Kuma’s WebSocket, notifications, or backend connectivity work. Always test an authenticated dashboard session and a live monitor update.
Bottom line
Run Uptime Kuma on its normal internal HTTP port, publish it through a dedicated hostname, terminate TLS at Caddy, Nginx, Apache, Traefik, or Cloudflare Tunnel, and preserve WebSocket upgrades. Caddy is the smallest native configuration; Nginx and Apache provide familiar manual control; Traefik fits label-driven Docker environments; and Cloudflare Tunnel avoids a separately managed reverse proxy. Whichever path you choose, keep port 3001 private, test from an external network, and enable Trust Proxy only after the proxy boundary is secure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
