Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable way to enable HTTPS for Uptime Kuma is to place Kuma behind a reverse proxy. The proxy owns your public hostname and TLS certificate, then forwards traffic to Kuma’s normal HTTP listener, usually port 3001. Use a domain or subdomain rather than a path such as example.com/uptimekuma; the official guide says a normal subdirectory deployment is not supported.
Because Uptime Kuma is WebSocket-based, the proxy must forward WebSocket upgrade requests as well as ordinary HTTP requests. The steps below cover Caddy, Nginx, Apache, Traefik, and Cloudflare Tunnel, including certificate handling, Docker deployments, proxy trust, and the failures that most often make a secured Kuma instance appear broken.
What HTTPS changes in an Uptime Kuma deployment
Uptime Kuma continues to run its built-in web service on HTTP, normally at http://127.0.0.1:3001. HTTPS is terminated at a reverse proxy (or at a tunnel service) in front of it:
- A DNS record sends
status.example.comto the proxy or tunnel. - The proxy obtains and presents the certificate for that hostname.
- The proxy forwards requests to Kuma on its private HTTP port.
- The proxy keeps the WebSocket connection open for live dashboard updates, logins, and notifications.
This arrangement encrypts traffic between visitors and the public endpoint while allowing Kuma to remain an internal service. The official Uptime Kuma reverse-proxy documentation says, “Unlike other web apps, Uptime Kuma is based on WebSocket,” and recommends SSL (HTTPS) with the web server to reduce man-in-the-middle risk on public networks. See the official Reverse Proxy guide.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Prerequisites and a safe starting layout
- A registered domain or subdomain, such as
status.example.com. A conventional subdirectory URL is not supported. - A DNS record pointing the hostname at the public IP of your reverse proxy, or at the endpoint required by your tunnel provider.
- Uptime Kuma running and reachable locally on port 3001. Confirm it first at
http://127.0.0.1:3001from the server. - Inbound TCP port 443 available for HTTPS. Caddy’s automatic certificate flow also needs port 80 reachable for normal HTTP validation and redirects; the exact validation method depends on your DNS and firewall setup.
- Administrative access to the proxy host and to Kuma’s Settings page.
- A firewall rule that exposes the proxy, not Kuma’s native port, to the internet. If the proxy is on another host, allow port 3001 only between those hosts.
Before changing anything, log in directly to Kuma and record the existing administrator account, notification settings, and monitor status. A proxy change should not require recreating monitors, but having a known-good local URL makes troubleshooting much faster.
Which HTTPS method should you use?
| Method | Certificate handling | Operational complexity | Separate proxy required? | Docker fit | Can port 3001 stay private? |
|---|---|---|---|---|---|
| Caddy | Automatic issuance and renewal when DNS and ports 80/443 are correctly configured | Lowest for a native installation | Yes; Caddy is the proxy | Use a shared proxy network and Caddy labels | Yes |
| Nginx | Use an existing certificate or Certbot with Let’s Encrypt; Certbot can add redirects and renewal | Moderate; configuration is explicit | Yes | Works with a host or containerized Nginx | Yes |
| Apache | Use certificate files or Certbot | Moderate; WebSocket rewrite rules are required | Yes | Works with Apache on the host or in a container | Yes |
| Traefik | Configured through entrypoints and a certificate resolver | Moderate; labels and resolver setup must match | Yes; Traefik is the proxy | Especially convenient for Docker labels | Yes |
| Cloudflare Tunnel | The tunnel supplies zero-configuration SSL | Low after the tunnel is created | No separate Nginx, Caddy, or Traefik proxy is needed | Provide the tunnel token in the Docker deployment’s Settings | Yes; the connector makes the outbound connection |
Choose Caddy if you want the shortest native configuration, Nginx or Apache if your server already standardizes on one of them, Traefik if your Docker platform is label-driven, and Cloudflare Tunnel if you do not want to expose an inbound web port or operate a separate reverse proxy. The tunnel approach is documented in the Uptime Kuma Cloudflare Tunnel guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common sequence for every deployment
- Create the hostname. Pick a dedicated name such as
status.example.comand create the required DNS record. - Keep Kuma on its normal internal port. Do not change the application to a made-up HTTPS port; the proxy forwards to port 3001 over the private network.
- Configure the proxy or tunnel. Set the public hostname, the upstream address, and WebSocket support.
- Issue the certificate. Use Caddy or Traefik automation, Certbot/Let’s Encrypt with Nginx or Apache, or the tunnel’s managed SSL.
- Restrict direct access. Bind or firewall port 3001 so it is not an unintended second public entry point.
- Test from outside the server. Open the HTTPS hostname from a separate network, sign in, wait for dashboard values to update, and trigger a test notification.
- Enable proxy trust only when appropriate. If every request reaches Kuma through your controlled proxy, configure Trust Proxy as described below.
Option A: Caddy
Native Caddy installation
Caddy can obtain and renew the certificate automatically. Its official Uptime Kuma example is deliberately short:
subdomain.domain.com {
reverse_proxy 127.0.0.1:3001
}Replace subdomain.domain.com with the hostname in your DNS record. Save the site in Caddy’s configuration, reload Caddy, and inspect its logs for certificate issuance or DNS/firewall errors. Automatic HTTPS works only when the hostname resolves to the Caddy server and the required public ports are reachable.
Docker with Caddy labels
Attach the Kuma container and Caddy to the same Docker network. The official Compose pattern uses labels equivalent to:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
caddy.reverse_proxy: "* {{upstreams 3001}}"The wildcard in this label tells Caddy to send requests to Kuma’s container port 3001. Your Caddy container still needs the hostname and certificate configuration used by the rest of your stack. Do not publish Kuma’s 3001 port to the public interface merely because Caddy can reach it over the shared network.
Free tools Windows power users keep installed
One-click scans. No signup required.
Option B: Nginx
Configure the HTTPS server block
Use an Nginx server block listening on 443 with the certificate and private-key paths. The important details are the original host and client-IP headers, HTTP/1.1, and the WebSocket headers:
server {
listen 443 ssl http2;
server_name sub.domain.com;
ssl_certificate /path/to/ssl/cert/crt;
ssl_certificate_key /path/to/ssl/key/key;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass http://localhost:3001/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}Replace the hostname and certificate paths. The trailing slash in proxy_pass keeps the root URL aligned with Kuma’s root application. Validate the Nginx configuration before reloading it, then browse to the HTTPS hostname.
Automated certificates with Certbot
The official instructions recommend starting with the Nginx “Without SSL” settings and then running Certbot with Let’s Encrypt. Certbot can populate the certificate directives, configure an automatic HTTP-to-HTTPS redirect, and set up renewal. Make sure the resulting renewal process can still reach the hostname after firewall or DNS changes; an expired certificate will make the dashboard unavailable even though Kuma itself is healthy.
Option C: Apache
SSL virtual host and proxy targets
Create an SSL virtual host on port 443 with SSLEngine On, SSLCertificateFile, and SSLCertificateKeyFile. Preserve the incoming host and proxy ordinary requests to http://localhost:3001/.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Apache needs a separate WebSocket path. The official Uptime Kuma example routes upgrade requests to ws://localhost:3001/ with rewrite rules and sends ordinary HTTP requests to the HTTP upstream. Use the exact rewrite rules from the official Apache section rather than treating Kuma as a static HTTP-only site. Without that split, the page may load while live status changes, authentication state, or notifications fail.
Certificate renewal
Certbot can manage the Apache certificate lifecycle as well. After enabling the virtual host, test both a normal page request and a WebSocket-dependent dashboard session after each Apache reload.
Option D: Traefik
For a Docker deployment, add Traefik labels that define all four pieces of the route: the hostname rule, the HTTPS entrypoint, TLS, and the certificate resolver. The service must point to container port 3001. Conceptually, the labels should specify:
- a router rule matching your real hostname;
- the HTTPS entrypoint used by your Traefik installation;
tls=true;- the certificate resolver name configured in Traefik;
- a load-balancer service port of
3001.
Replace the example hostname and resolver with your own values. A mismatch between the resolver label and Traefik’s configured resolver produces a route that exists but has no usable certificate. Keep Kuma and Traefik on the same Docker network and avoid publishing port 3001 externally.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOption E: Cloudflare Tunnel
A Cloudflare Tunnel is an alternative when you want the connector to make an outbound connection instead of opening an inbound proxy port. The Uptime Kuma guide states that a separate Nginx, Caddy, or Traefik reverse proxy is not needed and that the tunnel provides zero-config SSL.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Docker installation
- Create the tunnel and public hostname in your Cloudflare account.
- Use the tunnel token supplied for that tunnel in the Docker deployment’s Settings.
- Map the hostname to Kuma’s internal HTTP service on port 3001.
- Start the connector and verify that the hostname resolves to the tunnel.
Non-Docker installation
Install cloudflared on the Kuma host, authenticate it to the tunnel, and configure the hostname’s service target as Kuma’s local HTTP listener. Follow the hostname and token steps in the official tunnel documentation. Kuma still listens on HTTP locally; the tunnel is the public HTTPS boundary.
WebSocket forwarding: the detail that makes or breaks Kuma
A reverse proxy can return the initial HTML successfully while silently dropping the persistent WebSocket connection. Symptoms include a dashboard that never refreshes, monitors that appear stuck, repeated logouts, delayed notifications, or browser console errors about a failed WebSocket handshake.
- Nginx: use
proxy_http_version 1.1,proxy_set_header Upgrade $http_upgrade, andproxy_set_header Connection "upgrade"in the Kuma location. - Apache: route upgrade requests to
ws://localhost:3001/with the rewrite rules in the official configuration. - Caddy: its
reverse_proxyhandler supports WebSocket proxying; do not replace it with a static-file handler. - Traefik and a tunnel: keep the service target at port 3001 and do not add middleware that strips or blocks upgrade requests.
Trust Proxy and client addresses
When Kuma is completely behind your reverse proxy and the native listener is firewall-restricted, open Settings → Reverse Proxy → HTTP Headers and set Trust Proxy to Yes. Kuma will then trust the controlled X-Forwarded-* headers and can record the visitor’s client IP rather than the proxy’s address.
Do not enable this setting while users can bypass the proxy and connect directly to port 3001, or when untrusted clients can supply forwarded headers. In that situation, a client could spoof its address. First enforce the network boundary, then enable the setting and restart or reload only if your deployment requires it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Testing checklist after the change
- Visit the exact hostname with
https://and confirm the browser presents a valid certificate for that hostname. - Confirm that HTTP requests redirect to HTTPS when your proxy is configured to do so.
- Sign in, refresh the page, and leave the dashboard open long enough to see a monitor state update.
- Open browser developer tools and check that the WebSocket connection reaches the HTTPS endpoint without a 400, 404, or handshake error.
- Trigger a test notification and confirm that the event is generated while connected through the public hostname.
- From an external network, verify that
http://server-address:3001is not publicly reachable unless you intentionally need it. - Check proxy, tunnel, and Kuma logs for certificate renewal failures, upstream connection refusals, or repeated WebSocket reconnects.
Troubleshooting common failures
The browser shows a certificate warning
Check that DNS points to the machine actually serving the certificate, that the certificate includes the complete hostname, and that ports 80/443 or the tunnel validation path are reachable. For Nginx or Apache, verify the configured certificate and key paths and confirm that renewal has not failed.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The page loads but live data does not change
This is almost always an upgrade-forwarding problem. Recheck the Nginx headers or Apache WebSocket rewrite, ensure the proxy uses HTTP/1.1 to the upstream, and inspect the browser’s WebSocket handshake. Also check whether a second proxy, load balancer, or firewall is removing the upgrade headers.
Nginx, Apache, or Traefik returns 502 or 504
Test Kuma locally on port 3001 from the proxy host. If that fails, Kuma is stopped, listening on another address, or blocked by a container network rule. If local access works, check the upstream hostname, Docker network membership, and firewall rule between the proxy and Kuma.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Redirect loops occur
Ensure only one layer is responsible for HTTP-to-HTTPS redirection and that the proxy forwards the original host. A tunnel or upstream load balancer that already terminates TLS can create a loop if the inner proxy insists on redirecting a request that it sees as HTTP.
Client IPs show the proxy address
Confirm that the proxy sends X-Real-IP and X-Forwarded-For where applicable, then enable Trust Proxy only after direct access to Kuma has been blocked. If forwarded headers are absent, trusting them cannot recover the original address.
The HTTPS site works internally but not externally
Test DNS from an outside resolver, inspect the public firewall and NAT rules, and verify that the certificate authority can reach the hostname. Internal split-DNS records can hide an incorrect public record, while a tunnel requires the connector to remain online and authenticated.
Keeping the installation maintainable
- Document the public hostname, internal Kuma address, proxy configuration location, and certificate renewal method.
- Back up Kuma’s data volume separately from proxy configuration; HTTPS termination does not replace application backups.
- Keep the proxy and tunnel software updated, but reload configuration only after validating syntax.
- Monitor certificate expiry and the proxy process itself, not only the applications Kuma monitors.
- When migrating hosts, lower DNS TTL ahead of time, bring up the new proxy, verify WebSockets, and only then remove the old endpoint.
For most installations, the finished design is simple: DNS points to one HTTPS endpoint, that endpoint terminates TLS and preserves WebSockets, and Kuma’s port 3001 remains reachable only on the private side. Caddy minimizes configuration, Nginx and Apache provide explicit control, Traefik fits label-based Docker stacks, and Cloudflare Tunnel removes the need for an inbound reverse proxy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
