4 ways I secured my Plex server before exposing it to the internet

Published Aug 22, 2026, 11:30 AM EDT Jasmine is Software and PC Hardware Author at XDA with years of tech reporting experience ranging from AI chatbots right down to gaming hardware, she's covered just about everything. Whether it's breaking news about the latest AMD NPUs or creating video tutorials on social media platforms, Jasmine has contributed to the world of AI and tech in a variety of ways including interviewing the CEO of Razer, AMD's Director of Product Marketing and the VP of Lenovo. Passionate about gaming and PC technology, she has built countless computers, keyboards and other peripherals - knowing them inside and out. A default Plex setup has you enabling remote access in your server settings and then automatically triggering Universal Plug and Play, which opens external port 32400 directly through your router's firewall. Many users do this without realizing why default exposure is dangerous. Automated web bots and search engines continuously scan public IPv4 ranges for open 32400 end ports, probing for unpatched media server vulnerabilities, API exposure, and brute force targets. Safely exposing a media server requires moving beyond default settings by routing traffic through a hard and reverse proxy, enforcing strict access controls and strong authentication, isolating Plex on its own network, and automating update cycles. You can stream your library anywhere without compromising your home network. Reverse proxy Don't use default port 32400 Pillar number one for ensuring the best security when using Plex is to route traffic through a reverse proxy. Default port 32400 has a major flaw. Raw port forwarding is an antipattern. Exposing default application ports directly tells any port scanner exactly which service is running on your IP address. Instead, you could use a reverse proxy shield like Caddy or Nginx. A reverse proxy sits between WAN traffic and your media server. This means it restricts incoming traffic to standard HTTPS using a custom subdomain. It can also enforce modern TLS 1.3 encryption and automated Let's Encrypt certificate management, and it hides internal server IP addresses and port types from the public internet. To activate this, you have to use custom server access URLs in Plex. Go to your Plex server's Settings, then hit Network, and then you should see custom server access URLs. Official mobile, desktop, and smart TV apps should automatically connect through your encrypted reverse proxy rather than raw IP handshakes. Passwords should be secure And make use of mandatory 2FA Pillar number two is hardening authentication and limiting server access. Whenever you're using Plex, the best course of action is to ensure you use a strong password and enable mandatory 2FA for your root account. Enforce complex, unique master passwords backed by two-factor authentication to eliminate credential-stuffing vulnerabilities. You can also tighten your Plex-specific access controls. For example, in your settings, you can enable secure connections so they are always required. By default, it appears as preferred, but changing it to required can block unencrypted plain-text HTTP fallbacks. Another crucial step is to wipe the Networks Allowed Without Authentication settings. Ensure that the LAN IP Exception box in Plex Network settings is empty to prevent compromised local devices from accessing server controls without logging in. You can also use Plex Home and Managed Accounts properly so you never have to share primary admin credentials with household members or anyone else you grant access to. By creating separate profiles, you can grant library access scope and disable remote deletion rights for non-admin profiles, providing an extra layer of security. VLAN segmentation can make a big difference Keep the rest of your home secure Another step you can take, known as Pillar 3, is to isolate Plex on your local network. If you're running an unpatched media server, it's compromised on a flat network. An attacker gains immediate local access to your NAS storage, primary workstation, and sensitive smart home devices, making it a complete hazard. By using VLAN segmentation, you can place the media server in an isolated DMZ or server VLAN so that if it ever gets remotely accessed by a hacker, they don't have access to the rest of your network, either. Also, enforce strict firewall rules on your router to allow Plex to respond only to established/related sessions and block the Plex server from initiating outbound connections to your private home LAN. In addition to isolating Plex on your local network, you can isolate the container. There are some best practices you can use for Docker permissions and read-only volume mounts to keep Plex safe. You can mount media storage libraries as read-only, so a compromised container cannot alter or encrypt your media files. You can run the container under a non-root user ID, helping keep your files safe. Updates are crucial One missed patch can introduce vulnerabilities The last pillar for you to follow is to make sure you keep Plex and any other underlying infrastructure you use up to date. There's a major cost to patch delays. Media servers process untrusted external network inputs, audio/video codecs, and metadata passes, making zero-day patches critical. You're dealing with a lot of files that may not be 100% secure, so having the extra layer of protection is absolutely fundamental. You can make use of automated container patching. Modern update pipelines, such as Watchtower or automated Docker Compose rollouts, can automatically pull official Plex image updates and restart the service with zero downtime. This way, you don't even have to intervene to ensure you have the latest patch installed. Alongside this, keeping host Linux kernels, Intel Quick Sync drivers, and NVIDIA container toolkits up to date is just as important as updating the Plex application layer itself. All of these layers are vulnerable when they're not fully updated with the latest patches and security details. Protect your Plex server Remote media streaming is one of the most rewarding self-hosted projects, but convenience shouldn't come at the expense of your home network perimeter. Ensure that when you are using Plex, you have security measures in place to protect yourself. You can do this by closing port 32400, putting Plex behind a reverse proxy, and isolating its container on a separate VLAN. And enjoy your personal media streaming setup with complete peace of mind.