Nginx Proxy Manager vs Traefik
Nginx Proxy Manager vs Traefik for self-hosters in 2026: GUI vs labels, Let's Encrypt and DNS challenges, middlewares, Kubernetes support, config-as-code and upgrade risk.
Quick Answer
Nginx Proxy Manager is the pick when you want to click a domain, a forward host and a certificate into a web UI and be done. Traefik is the pick when your services already live in Docker Compose or Kubernetes and you want routes, TLS and middlewares to follow the containers through labels or manifests, kept in Git.
Last updated October 24, 2026. Covers Nginx Proxy Manager v2.16.0 (24 Sep 2026) and the 2.14/2.15 changes, and Traefik v3.7.16 and v2.11.60 (20 Oct 2026), with Traefik Hub-only middlewares as documented for v3.7.
| Feature | Nginx Proxy Manager | Traefik |
|---|---|---|
| Licence | MIT | MIT |
| Latest Release (Oct 2026) | v2.16.0 (24 Sep 2026) | v3.7.16 (20 Oct 2026); v2.11.60 still patched |
| Configuration Model | Web UI forms (plus optional raw Nginx snippets) | Dynamic providers: labels, Kubernetes resources, KV stores, files |
| Web UI | Full admin UI for creating and editing hosts | Read-only dashboard of routers, services and middlewares |
| Docker Label Auto-Discovery | ||
| Kubernetes Support | Not a target (Docker image only) | Ingress, Gateway API, IngressRoute CRDs, Knative |
| Let's Encrypt Challenges | HTTP-01 and DNS-01 via Certbot | HTTP-01, TLS-ALPN-01, DNS-01 via lego |
| DNS-01 Providers | 88 Certbot DNS plugin definitions | lego's DNS provider list (one provider per resolver) |
| Built-in Access Control | Access lists, basic auth, IP allow/deny | BasicAuth, DigestAuth, ForwardAuth, IPAllowList (OIDC/JWT in Traefik Hub) |
| TCP / UDP Proxying | Yes (Streams) | Yes (TCP and UDP routers) |
| Where Config Lives | SQLite / MySQL / MariaDB / PostgreSQL | Your files, labels or cluster objects |
| HTTP API | REST API (OpenAPI 3.1, JWT auth) | Read API behind the dashboard |
| Metrics / Tracing | Logs viewer in UI (v2.16.0); no built-in metrics exporter documented | Access logs, metrics (incl. OTLP), tracing |
Nginx Proxy Manager
MIT-licensed Docker image that wraps OpenResty (Nginx) and Certbot in a Tabler-based admin UI, so you can create proxy hosts, redirects, streams and Let's Encrypt certificates without writing Nginx config.
Pros
- Fastest path from zero to a working HTTPS reverse proxy: one compose file, then everything happens in the UI on port 81
- Free Let's Encrypt certificates with HTTP or DNS validation, and the repo ships definitions for 88 Certbot DNS plugins
- Access lists and HTTP basic auth per host, plus per-path access lists added in v2.16.0
- Multiple users with permissions and an audit log, useful when someone else also manages hosts
- Advanced Nginx snippets per host and global include files under /data/nginx/custom for anything the UI does not cover
- Streams forward raw TCP/UDP ports, e.g. for game servers or databases
Cons
- Every host is created by hand in the UI or via its API; nothing is discovered from container labels
- State lives in a database (SQLite by default, MySQL/MariaDB or PostgreSQL optional), so config-as-code and Git review are not native
- Docker-only packaging, and no armv7 images since 2.14, so older 32-bit Pis are stuck on 2.13.7
- Certbot DNS plugins can conflict with each other; the docs warn against mixing DNS providers in one instance
- 2026 releases fixed a role-escalation bug (2.15.0) and an escaping issue that could allow RCE (2.16.0), so the admin port must stay private and updates matter
Best For
Homelabs and small VPS setups with a handful of services, where you want a GUI and certificates that renew themselves, and the person running it may not want to touch Nginx config.
Traefik
MIT-licensed cloud-native reverse proxy and load balancer written in Go that builds its routing table dynamically from providers such as Docker labels, Kubernetes Ingress/Gateway API/CRDs, Consul, Nomad and files.
Pros
- Routes appear and disappear with containers: add labels to a compose service and Traefik picks it up, no proxy restart
- First-class Kubernetes support: Ingress, Gateway API, its own IngressRoute CRDs, and a provider that reads ingress-nginx annotations
- Built-in ACME client (lego) with HTTP-01, TLS-ALPN-01 and DNS-01, including wildcard certificates
- 24 open-source HTTP middlewares, including ForwardAuth (for Authentik, Authelia and similar), rate limiting, circuit breaker, retry and headers
- Configuration is plain YAML/TOML/labels, so it lives in Git and goes through code review like the rest of the stack
- Built-in access logs, metrics (OTLP and others) and tracing; v3.7 and v2.11 both received patch releases on 20 Oct 2026
Cons
- Steeper learning curve: entrypoints, routers, services and middlewares, plus the split between install and routing configuration
- The dashboard shows active routes but is not where you edit them, and the docs warn not to expose it with api.insecure in production
- OIDC, JWT, Coraza WAF, OPA and distributed rate limiting are Traefik Hub features, not part of the open-source proxy
- Let's Encrypt with several Traefik instances needs cert-manager or the commercial Traefik Enterprise; the open-source acme.json is single-instance
- Mounting the Docker socket into the proxy container is the usual setup, which gives it broad access to the host
Best For
Docker Compose or Kubernetes users who deploy services often and want routing, TLS and auth to be declared next to each service and versioned in Git.
GUI versus labels: two different ways of working
Nginx Proxy Manager (NPM) is built around its admin UI. You start one container from a short compose file that publishes ports 80, 443 and 81, open port 81, and add a proxy host by typing the domain, the forward hostname and port, and ticking a box for an SSL certificate. NPM writes the Nginx config for you. When something is missing, you can paste Nginx directives into a host's advanced tab or drop include files into /data/nginx/custom. Traefik inverts that. You start the proxy once with entrypoints and providers, and from then on each service describes its own routing. In Docker that means labels such as traefik.http.routers.whoami.rule=Host(`whoami.example.com`) on the service itself; in Kubernetes it means Ingress, Gateway API or IngressRoute objects. Traefik watches the provider and updates routes when containers start or stop. The practical difference shows up on the tenth service. With NPM you click through the same form again, and the source of truth is NPM's database. With Traefik the route is in the same compose file or manifest as the app, so it is reviewed, copied and rolled back together with it. Neither approach is wrong; they suit different people.
Certificates and DNS challenges
Both tools get free certificates from Let's Encrypt, but they use different ACME clients. NPM uses Certbot and, for DNS validation, installs the Certbot DNS plugin for the provider you choose. The repository's dns-plugins.json currently defines 88 providers. NPM's own Certbot page is candid about the trade-off: plugins are maintained separately, some lag behind Certbot, and using more than one DNS provider in the same instance can cause Python dependency conflicts. The 2.15.0 and 2.16.0 release notes both warn that DNS plugins may need tweaks after the Certbot upgrade. Traefik embeds lego, a Go ACME library, so there is nothing extra to install. A certificate resolver can use HTTP-01, TLS-ALPN-01 or DNS-01, and DNS-01 gives you wildcard certificates. Traefik supports one DNS provider per resolver; its docs suggest CNAME delegation if your domains sit with different DNS hosts. The gap that matters at scale is high availability. Traefik's open-source ACME storage is a local acme.json, and its docs say that for Let's Encrypt across several instances you should use cert-manager or the commercial Traefik Enterprise. NPM is a single container by design, so the question does not really arise.
Auth, middlewares and where each one stops
NPM gives you access lists: HTTP basic auth users plus allow and deny rules by IP, attachable to a proxy host, and since v2.16.0 to individual paths. That covers the common homelab need of keeping an admin panel away from the internet. NPM's FAQ notes one sharp edge: if the app behind the proxy also uses the Authorization header, basic auth on the proxy breaks the app's own login. Anything beyond that needs custom Nginx directives. Traefik's open-source proxy ships 24 HTTP middlewares, from StripPrefix and Headers to RateLimit, CircuitBreaker, Retry, InFlightReq and ForwardAuth. ForwardAuth is the important one for self-hosters, because it is how you put an identity provider such as Authentik or Authelia in front of every service with one label. Middlewares chain, and you can reference one defined in a file from a Docker label. The Traefik docs also list OIDC, JWT, OPA, LDAP, HMAC, a native Coraza WAF and distributed rate limiting, but each of those pages is marked as available exclusively in Traefik Hub, the commercial product. If you assumed native OIDC in the free proxy, plan on ForwardAuth plus an external IdP instead.
Operations: upgrades, security and scale
NPM upgrades are docker compose pull and up; the app migrates its own database. The 2026 changelog shows why you should still read release notes: 2.14.0 dropped armv7 images, 2.15.0 moved to a Debian Trixie base and fixed a bug that let any authenticated user change their own roles, and 2.16.0 fixed an escaping order that could lead to remote code execution, invalidated tokens issued before a password change, and stopped leaking 2FA secrets to a third-party QR service. The project is active, with about 34,500 GitHub stars, but the admin UI on port 81 is a real attack surface. Keep it on a private network or VPN. Traefik is a single Go binary that also runs as a container, a Helm chart or a Kubernetes ingress controller. Both the v3.7 and v2.11 lines got patch releases on 20 October 2026, so users still on v2 are not stranded yet. Its usual Docker setup mounts the Docker socket, which deserves the same care as NPM's admin port. For scale, Traefik wins clearly: multiple replicas, Kubernetes, Swarm, Nomad and Consul are all supported providers, and metrics and tracing are built in. NPM is meant to be one container in front of one network.
Verdict
Choose Nginx Proxy Manager if you run a small, fairly static set of services, want to manage domains and certificates from a browser, and value getting HTTPS working in ten minutes over keeping proxy config in Git. Keep its admin port off the internet and update promptly. Choose Traefik if your services are defined in Docker Compose or Kubernetes, change often, or need middlewares like ForwardAuth for SSO; the extra learning pays off once you have more than a few hosts or more than one environment. If you run Kubernetes at all, Traefik is the only one of the two that fits. Both are MIT-licensed and free, so cost is not the deciding factor; the deciding factor is whether you want a GUI or config-as-code.