An ngrok hostname does not establish that a site or sender is trustworthy. Confirm who sent the link and what you expect to find before you enter credentials or download files. HTTPS and the browser warning do not certify the site's content. Report suspicious links through our abuse reporting page.

Email abuse@ngrok.com with the full endpoint URL and a description of what you observed. Include the time and time zone, plus relevant screenshots or log excerpts with secrets removed, when available. Our abuse reporting page explains what to include and what happens next.

Yes. It's at status.ngrok.com.

Yes, and ngrok doesn't charge it. It's an abuse control. Add a credit or debit card in your account settings and TCP endpoints unlock. Prepaid cards don't count, and removing the card locks TCP endpoints again.

No. Some antivirus tools flag ngrok because bad actors also use it, and ngrok works with those vendors to fix the classification. Download the agent from ngrok.com and check that ngrok signed the binary. A valid signature confirms the publisher, not that the installation or its use is authorized. The docs FAQ explains what to check.

Automated systems detect abuse and disable abusive accounts and endpoints on their own. A dedicated team reads and triages every abuse report, and we work with security vendors and ISPs to take down phishing and malware campaigns. Our abuse reporting page explains how to report suspected abuse and what happens next.

A developer, administrator, or software vendor may have installed ngrok to connect a local service. If you don't recognize it, ask your IT team or vendor who installed it, why it is needed, and which services it connects. The docs FAQ explains how to assess an unexpected installation.

Yes. Every endpoint sits behind ngrok's firewall, and Traffic Policy adds rate limits and IP restrictions on top. The DDoS protection page lists the extra measures.

No. HTTP endpoints listen on port 80, and HTTPS and TLS endpoints on port 443. A TCP endpoint uses the port ngrok assigned with its TCP address.

Yes. When you switch Wi-Fi or your IP changes, the agent notices and reconnects on its own.

The Terms of Service and the Data Processing Agreement spell it out.

Yes. Serve the CORS headers from your app, or add them at the edge with the add-headers Traffic Policy action. With an auth action in front, it blocks preflight requests by default, so add an expression that skips auth for them. The docs FAQ has the details.

The open source 1.x agent is still on GitHub, but nobody maintains it. Download the current agent instead.

en-grok.

The first commit landed on March 20, 2013.

They want a persistent, secure connection between their network and yours, so they can reach a service you run. Before you install it, confirm which services they need, who controls access, how to review activity, and how to revoke access. The end customer guide covers these questions and the available controls.