How to Fix n8n Webhooks Behind a Reverse Proxy

If n8n generates an internal or incorrect webhook URL behind a reverse proxy, set N8N_WEBHOOK_URL to the public webhook base URL, set N8N_PROXY_HOPS to the number of trusted proxy hops, and make sure the final proxy forwards X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto. Then verify the running n8n process received the settings and that the public route reaches the webhook endpoint.

Why reverse proxies can break n8n webhook URLs

By default, n8n builds webhook URLs from N8N_PROTOCOL, N8N_HOST, and N8N_PORT. Behind a proxy, those values may describe the private n8n service rather than the public address that an external service or user must reach. For example, n8n may listen internally on port 5678 while the proxy exposes the site over HTTPS on port 443. The resulting URL can show an internal hostname, the wrong scheme, or an internal port. n8n’s reverse-proxy guidance explains this mismatch.

#	Preview	Product	Price
1		Island PRO Router	$1,093.20	Buy on Amazon

The fix is to tell n8n its public webhook base URL and how many proxy hops to trust, then pass the original request details through the proxy chain.

Set the public webhook URL and proxy hop count

For a deployment with one trusted reverse-proxy hop, the minimal environment example is:

#1 Best Overall

Island PRO Router

• UPC: 198715002478
• Weight: 9.450 lbs

$1,093.20

Buy on Amazon

export N8N_WEBHOOK_URL=https://n8n.example.com/
export N8N_PROXY_HOPS=1

Replace the example hostname with the public hostname users and external services can reach. Include any deployment-specific base path. The trailing slash follows n8n’s documented example. Set the hop count to your actual trusted proxy path; 1 is an example, not a universal value. The n8n guide describes these settings for reverse-proxy deployments.

N8N_WEBHOOK_URL is the base URL for both test and production webhooks. The current n8n endpoint environment-variable reference lists it for deployments behind a reverse proxy. That reference says WEBHOOK_URL is deprecated starting with n8n 2.35.0; it remains an alias but triggers a startup deprecation warning. Use N8N_WEBHOOK_URL for current configurations, and check the documentation matching your deployed version.

Forward the original request details from the final proxy

The last proxy in the request path must forward these headers so n8n can recover the original request information:

• X-Forwarded-For
• X-Forwarded-Host
• X-Forwarded-Proto

Proxy products use different configuration syntax. n8n’s guide specifies the headers to forward but does not provide a universal, product-specific configuration block. Ensure the proxy that directly contacts n8n sends all three, and account for any additional trusted proxies when choosing N8N_PROXY_HOPS.

Troubleshoot the failure in order

1. Inspect the URL in the n8n webhook node. Check that it uses the public hostname and, when TLS terminates at the proxy, the public HTTPS scheme. It should not expose an internal hostname or port.
2. Correct the base URL. Set N8N_WEBHOOK_URL to the externally reachable base address, such as https://n8n.example.com/, adjusted for your host and any base path.
3. Match the trusted hop count. Set N8N_PROXY_HOPS to the number of proxies in the trusted request path. n8n documents 1 as an example.
4. Check the final proxy’s headers. Confirm it forwards X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto.
5. Confirm the live process received the environment. Update the environment used by the container or process manager, then restart or redeploy n8n as needed. A community report describes a PM2 deployment where pm2 restart n8n --update-env refreshed the process environment and corrected the displayed URL; this is a deployment-specific example, not a general restart command. Read the PM2 community report.
6. Separate registration from delivery. If an external service rejects or does not call the webhook, check that it registered the current public HTTPS URL, then test whether requests to the public route reach n8n. The next diagnostic steps depend on the service and the observed error.
7. Investigate editor-only symptoms separately. If the URL is correct but the editor behaves unexpectedly, inspect browser-console errors and response headers. One community report attributed an individual problem to a restrictive CSP header, but it does not establish CSP as a general cause of webhook delivery failures. Do not remove security headers as a blanket fix. See the community report.

When the settings look right but the webhook still fails

Use the symptom to choose what to check next rather than changing proxy settings at random:

• The displayed URL is wrong: verify the public base URL and confirm the running process received it.
• The displayed URL is right, but an external service rejects it: check whether the service registered the current public HTTPS URL. The specific error may point to that service’s URL requirements.
• The service accepts the URL but delivery fails: check the public route and proxy forwarding path to establish whether the request reaches n8n.
• Only the editor or browser experience is affected: inspect browser-console errors and response headers as deployment-specific clues, without treating one community report as a universal diagnosis.

The exact proxy syntax, environment-injection method, and route diagnosis depend on your proxy, process manager or container setup, external trigger, and error message.

Quick Recap

Bestseller No. 1

Island PRO Router

UPC: 198715002478; Weight: 9.450 lbs

$1,093.20

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.