How to Secure Your Plex Server -- SSL, Authentication, and Best Practices

Published September 1, 2026 · 10 min read

A Plex server with remote access enabled is a service exposed to the internet. Even though Plex handles authentication through plex.tv, there are layers of security you should configure to protect your server, your data, and your network. An unsecured Plex server can leak metadata about your library to anyone who discovers the IP address, serve as an entry point for network attacks, or be abused as part of amplification attacks.

This guide covers every security measure available for Plex: encrypted connections, two-factor authentication, network isolation, and operational best practices that reduce your attack surface.

Plex's Built-in SSL

Plex includes built-in SSL/TLS encryption for connections between clients and the server. This is managed through Plex's own certificate infrastructure and does not require you to obtain or manage certificates.

How It Works

When your Plex server connects to plex.tv, it receives a certificate that is signed for a subdomain of plex.direct. This subdomain resolves to your server's IP address. Clients connect to this subdomain using HTTPS, and the connection is encrypted end-to-end. The certificate is automatically renewed, and you do not need to configure anything for this to work.

Secure Connection Settings

In Settings, Network, you will find the "Secure connections" dropdown with three options:

• Preferred (default): Plex attempts a secure connection first. If it fails (due to network conditions or client limitations), it falls back to an insecure HTTP connection. This is the best balance for most users.
• Required: All connections must use HTTPS. If a client cannot establish a secure connection, it is denied access. This is the most secure option but may cause connectivity issues on some networks, particularly those with restrictive firewalls or proxies that interfere with SSL.
• Disabled: All connections use unencrypted HTTP. Never use this option unless you are debugging a specific connectivity problem, and switch back immediately afterward.

Recommendation: Use "Required" if all your users have modern Plex apps and reliable network connections. Use "Preferred" if you share with users on varied networks where you cannot guarantee SSL will work. Never leave it on "Disabled" in production.

Custom Domain with Reverse Proxy SSL

For users who want additional control over their SSL configuration, you can place Plex behind a reverse proxy (such as Nginx or Caddy) with your own domain and Let's Encrypt certificate. This approach offers several advantages:

• Use your own domain name (e.g., plex.yourdomain.com) instead of the plex.direct subdomain
• Centralize SSL termination for multiple self-hosted services
• Apply additional security headers and rate limiting at the proxy level
• Use wildcard certificates or certificates from your preferred certificate authority

If you use a reverse proxy, configure Plex's custom connection URL in Settings, Network, "Custom server access URLs" to point to your proxy's address. This tells Plex to advertise your custom domain to clients instead of the default plex.direct address.

For a detailed reverse proxy setup, see our Nginx reverse proxy guide.

Two-Factor Authentication

Two-factor authentication (2FA) adds a second layer of verification to your Plex account login. Even if someone obtains your password, they cannot access your account without the second factor.

Enabling 2FA

1. Log in to your Plex account at app.plex.tv.
2. Go to Account Settings, then Security.
3. Select "Enable Two-Factor Authentication."
4. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, or any TOTP-compatible app).
5. Enter the verification code to confirm.
6. Save the backup codes in a secure location. These codes let you regain access if you lose your authenticator device.

Important Considerations

• 2FA protects your plex.tv account login. It does not add a second factor to individual server connections -- those are authenticated via tokens issued after the initial login.
• Shared users should enable 2FA on their own Plex accounts independently. You cannot force 2FA on users you have shared your library with.
• If you lose access to your authenticator and your backup codes, recovering your account requires contacting Plex support. This process can take time, during which your server is inaccessible for administration.

Network Isolation

Your Plex server does not need full access to your home network, and your home network does not need unrestricted access to the server. Isolating the server reduces the impact of a potential compromise.

VLAN Segmentation

If your router supports VLANs, place the Plex server on a separate VLAN from your personal devices. Configure firewall rules to allow:

• Inbound connections to port 32400 (or your custom port) from the internet and your LAN
• Outbound connections from the server to the internet (for plex.tv communication, metadata downloads, and remote streaming)
• Access to your NAS or media storage from the server VLAN

Block all other traffic between the server VLAN and your personal devices. If the Plex server is compromised, the attacker cannot pivot to your computers, phones, or other devices.

Firewall Rules

At minimum, configure your router's firewall to:

• Only forward port 32400 (or your custom port) to the Plex server. Do not open additional ports unless you have a specific need.
• Block inbound access to the Plex server's SSH port (22) from the internet. SSH should only be accessible from your LAN.
• If your Plex server runs on an OS with its own firewall (Linux iptables/nftables, Windows Firewall, macOS pf), configure it to accept connections only on port 32400.

Disable DLNA

Plex includes a DLNA (Digital Living Network Alliance) server that broadcasts media to DLNA-compatible devices on your local network. DLNA has no authentication -- any device on the same network can browse and play your content without logging in to Plex.

Unless you have specific DLNA devices that you actively use (some older smart TVs, some media players), disable the DLNA server in Settings, DLNA, "Enable the DLNA server." This removes an unauthenticated access path to your media.

Signed-Out User Restrictions

By default, Plex allows local network users to access the server without signing in. This is convenient for devices on your home network but means anyone who connects to your WiFi can browse your library.

In Settings, Network, find the "List of IP addresses and networks that are allowed without auth" field. By default, your local subnet is included. Remove it if you want every connection to require Plex authentication, even on your local network. This is particularly important if you have guests on your WiFi or if your network is not well-secured.

Server Administration Best Practices

Keep Plex Updated

Plex regularly releases security patches. Run the latest stable version and enable automatic updates if your platform supports it. Check for updates at least monthly if you update manually.

Use Strong Passwords

Your Plex account password should be unique (not reused from other services), long (at least 16 characters), and generated by a password manager. This password protects not just your media library but also your server's administrative controls, your sharing permissions, and your payment information if you have a Plex Pass.

Audit Shared Users Regularly

Review who has access to your server periodically. Go to Settings, Users and Sharing, and remove anyone who no longer needs access. Each shared user is a potential entry point -- if their Plex account is compromised, the attacker gains access to your server (though only with the permissions you have granted to that user).

Monitor Access Logs

Use Tautulli or Plex's built-in dashboard to monitor who is accessing your server, from where, and when. Unusual patterns -- such as access from unexpected countries, login attempts at odd hours, or streams from devices you do not recognize -- may indicate a compromised account.

Disable Unused Features

Every enabled feature is potential attack surface. If you do not use Plex's web hooks, disable them. If you do not use the built-in news or podcast features, disable them. If you do not share your server remotely, disable remote access entirely. Each disabled feature is one less thing that can be exploited.