site on
HTTPS
By default, Caddy automatically obtains and renews TLS certificates for all your sites.
HTTPS/TLS for custom domains
The secret sauce of almost every white-label SaaS is Caddy's original On-Demand TLS feature. Grow your SaaS business by orders of magnitude with ease!
Dynamically provision certificates
With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains.
Massively scale your TLS
Other web servers and scripted certificate tools fall over with hundreds of thousands of sites or thousands of instances. Caddy is designed to manage certificates reliably at this scale.
sponsored by users like you
Caddy is free software and relies on sponsorships to survive. Not just donations: sponsorships ensure ongoing development and provide your business with tangible benefits.
See sponsorshipsThe most advanced HTTPS server in the world
All you need for TLS and PKI 🔐
Caddy securely serves all sites with TLS by default. It can also manage your internal PKI for you across a fleet of servers and clients.
On-line config API ⚡️
Caddy's native configuration is a JSON document that you can export and manipulate with a RESTful config API.
PCI, HIPAA, and NIST compliant ✅
Caddy's TLS defaults are secure and pass PCI, HIPAA, and NIST compliance requirements. Yes, defaults: no hassle required.
HTTPS for localhost 🏠
We mean it when we say Caddy serves every site on HTTPS. Even localhost and internal IPs are served with TLS using the intermediate of a fully-automated, self-managed CA that is automatically installed into most local trust stores.
Cluster coordination 🌐
Simply configure multiple Caddy instances with the same storage, and they will automatically coordinate certificate management and share resources such as keys and OCSP staples!
Experience it
Discover Caddy's automagic HTTPS features.
Point any subdomain named caddydemo to:
A
1.2.3.4
AAAA
::f00
Then visit it in your browser.
You'll notice how Caddy provisions a certificate for your domain automatically.
Not working? Make sure to use a subdomain of a registered domain, not a "sub-subdomain." Verify you have created the public DNS records shown above with the correct values. You may have to allow time for propagation. Consult your DNS provider's documentation or support for more information.
Example subdomains that could work: caddydemo.example.net, caddydemo.example.co.uk
Caddy is capable of serving TLS for any domains and IPs. This demo is intentionally restricted.
All you need for TLS and PKI
Caddy is not only the world leader in certificate automation, it is also a fully-featured certificate authority for your own internal PKI.
Caddy 2 is a highly extensible, self-hosted platform on which you can build, configure, and deploy long-running services ("apps").
Caddy ships with apps for an HTTPS server (static files, reverse proxying, load balancing, etc.), TLS certificate manager, and fully-managed internal PKI. Caddy apps collaborate to make complex infrastructure just work with fewer moving parts.
For example, the config shown here keeps your TLS certificates renewed for other programs to use; no external tools or HTTP daemon required!
Providing a unified configuration, on-line config API, and automatic documentation for all apps, Caddy is nearly infinitely extensible. Thanks to its unique modular architecture, we can offer unlimited features without bloating the code base.
{
"apps": {
"tls": {
"certificates": {
"automate": [
"example.com",
"sub.example.com",
"example.net"
]
}
}
}
}A forward-thinking reverse proxy
Caddy's proxy was designed to be as forward-compatible as possible and has major batteries included: load balancing, active and passive health checks, dynamic upstreams, retries, pluggable transports, and of course, best-in-class TLS security.
Proxy HTTP, FastCGI, WebSockets, and more
Capable of proxying HTTP and HTTPS, but also WebSockets, gRPC, FastCGI (usually PHP), and more! The underlying transport module is extensible for any custom way to generate an HTTP response.
Dynamic backends
Provide Caddy with a static list of backends or enable a module to retrieve backends dynamically during each request: ideal for rapidly changing environments. Caddy flows with your infrastructure!
High availability
Caddy comes with a whole suite of high availability (HA) features: advanced health checking, graceful (hitless) config changes, circuit breaking, load limiting, on-line retries, and more. The best part? It's all free. No enterprise-level paywalls.
example.com
# Serve PHP sites
handle /blog/* {
root * /var/www/wordpress
php_fastcgi localhost:9000
file_server
}
# Proxy an autoscaling API with dynamic backends
reverse_proxy /api/* {
dynamic srv _api._tcp.example.com
}
# Proxy a compute-heavy distributed service
# with load balancing and health checks
reverse_proxy /service/* {
to 192.168.1.1 192.168.1.2 192.168.1.3
lb_policy least_conn
lb_try_duration 10s
fail_duration 5s
}
# Proxy everything else to an HTTPS upstream
reverse_proxy https://service.example.com {
header_up Host {upstream_hostport}
}
software assurance
Without sponsorships, Caddy could stop being developed at any time. With sponsorships, you gain peace of mind knowing that the project will continue to be developed, along with tangible benefits like private support and training.
See sponsorships
Sean Lin
Example product manager
Production-grade static file server
Serving static files is a tried-and-true method of delivering sites to numerous clients efficiently. Caddy has a robust file server that can be combined with other middleware features for the ultimate effortless website.
Compression
Caddy can compress files on-the-fly or serve precompressed files for extra performance. Caddy is also the first web server to support Zstandard encoding.
Virtual file systems
Serve your static site from anything: the local file system, remote cloud storage, a database, or even embedded in the server binary!
Range requests, Etags, and more
Unlike many ad-hoc file servers intended for temporary local development, Caddy fully supports Range requests, Etags, and a full production feature set.
Directory file browser
If a directory without an index file is requested, Caddy can show an elegant file browser with breadcrumb nav, file size visualizations, filetype icons, and a grid view.
example.com
root * /var/www
# Serve precompressed files if present
file_server /downloads/* {
precompressed gzip zstd br
}
# Compress everything else that would benefit
encode zstd gzip
# Get files from a database
file_server /database/* {
fs sqlite data.sql
}
# Get files from within the Caddy binary
file_server /embedded/* {
fs embedded
}
# (Range/Etag/etc. all work without extra config)
# Serve static site with directory listings as needed
file_server browse
Flexible configuration compatible with any workflow
Configure your server your way. Caddy's native configuration format is JSON, but with Caddy's config adapters, you can use any config format you prefer. All configuration is posted through a RESTful admin API, and Caddy's CLI helps you work with config files easily.
$ caddy start --config caddy.json
$ curl localhost:2019/id/my_handler \
-X PATCH \
-H "Content-Type: application/json" \
-d '{
"handler": "static_response",
"body": "Work smarter, not harder."
}'
$ curl localhost:2019/config/ | jq
JSON config API
Caddy's native config format is JSON, giving you incredible power and flexibility for automated, large-scale deployments.
Make dynamic config changes through an intuitive, programmable REST API that offers ACID guarantees. It is also safely scoped, meaning that the URI path restricts changes, making it impossible to accidentally alter other parts of your config.
Caddyfile
Most people prefer to use a Caddyfile because it lets you get a production-ready site up and running in just a few hand-written lines. It's not uncommon for Caddyfiles to be just ~15% the size of a less-capable nginx config!
caddyserver.com
root * src
file_server
templates
encode zstd gzip
redir /docs/json /docs/json/
rewrite /docs/json/* /docs/json/index.html
rewrite /docs/* /docs/index.html
reverse_proxy /api/* localhost:9002
$ caddy run \
--config nginx.conf \
--adapter nginx
Config adapters
Power Caddy with anything, even NGINX config files!
With first-class support for config adaptation, you can configure your web server with your favorite format: YAML, TOML, CUE, NGINX, HCL, Dhall, JSON with comments, or even a MySQL database. The Caddyfile is a built-in config adapter.
Unparalleled extensibility
Caddy is the only server in the world with its novel, modular architecture. At its core, Caddy is a configuration manager that runs apps like an HTTP server, internal certificate authority, TLS certificate manager, process supervisor, and more.
And because of its unique design, all these features are freely available without bloating the software. Only compile in what you need.
Unlimited power
Nearly every part of the config that "does something" is pluggable. Caddy offers so much in such a lean package.
Native CPU performance
No RPC calls or flimsy dependency management. Plugins are compiled into the static binary, making successful deployments certain and runtimes blazing fast.
Easy to develop
Writing Caddy plugins is as easy as writing a Go package.
The gold standard web server
Caddy keeps your sites up when other servers let you down.
Dynamically provision certificates
With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains.
Dynamically provision certificates
With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains.
Dynamically provision certificates
With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains.