Proxy Mode
Advanced deployment using reverse proxy configuration for deeper trap coverage.
Proxy mode extends your protection beyond the standard beacon by serving trap paths directly from your own domain through a reverse proxy. Instead of pointing to an external beacon domain, trap endpoints like /.env or /api/v1/config respond from your own infrastructure -- making them indistinguishable from real files.
Proxy mode requires a Pro plan or higher. Free-tier accounts use beacon mode, which provides detection via a script tag. Upgrade from your dashboard to unlock proxy deployment.
Supported Proxy Platforms
LobsterHoney generates ready-to-use configuration for 8 proxy platforms:
| Platform | Format |
|---|---|
| Cloudflare | Worker script |
| Nginx | Location blocks |
| Caddy | Reverse proxy directives |
| Apache | ProxyPass rules |
| HAProxy | Backend/frontend config |
| Vercel | Rewrites in vercel.json |
| Netlify | Redirect rules |
| Next.js | Middleware rewrites |
Setting Up Proxy Mode
Select your proxy platform
On the Deploy page, choose your proxy platform from the platform picker. LobsterHoney generates the exact configuration you need.
Copy the generated config
The Deploy page provides a copy-ready configuration snippet. It includes both trap path forwarding and callback route proxying so detection signals flow back correctly.
Add to your server or edge config
Paste the configuration into your server, CDN, or edge function. The exact location depends on your platform -- the Deploy page includes platform-specific instructions.
Run proxy verification
After adding the config, run the proxy verification check from the Deploy page. This tests each trap path and the callback route to confirm everything is forwarding correctly.
How Proxy Verification Works
Proxy verification tests each trap path individually and checks the callback route. For each path, it confirms:
- The path returns a valid response (not 404 or 502)
- The response contains expected trap content
- The callback route is reachable for signal delivery
If any path fails, the verification report tells you exactly which paths need attention.
Beacon vs. Proxy
Beacon mode is simpler to deploy -- a single script tag. Proxy mode provides deeper coverage because trap paths live on your own domain, making them more realistic to scanning agents. For maximum protection, use proxy mode with all available trap types.
See Also
- Beacon Setup -- simpler deployment via script tag
- Verifying Deployment -- confirming your setup
- Managing Traps -- controlling which traps are active