diff --git a/docs/server-client-mode-remote.md b/docs/server-client-mode-remote.md
index f40bf6c..6b1b13d 100644
--- a/docs/server-client-mode-remote.md
+++ b/docs/server-client-mode-remote.md
@@ -61,18 +61,33 @@ idea --serve \
 
 This example is for a reverse proxy running on the same machine as the server.
 If the proxy runs on another machine, bind an address reachable by that proxy,
-for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that
-address and port. The link from proxy to server is still plain HTTP on the LAN;
-only the public access is HTTPS.
+for example `--listen 192.0.2.75:17373`, and point the proxy upstream to that
+address and port. Also authorize only that proxy peer:
+
+```bash
+idea --serve \
+  --listen 192.0.2.75:17373 \
+  --allow-remote \
+  --public-origin https://idea.example.com \
+  --trust-reverse-proxy \
+  --trusted-proxy 192.0.2.22
+```
+
+The link from proxy to server is still plain HTTP on the LAN; only the public
+access is HTTPS.
 
 For any non-loopback bind, keep the full remote HTTPS configuration:
-`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`.
-`ServerConfig::validate()` rejects a non-loopback bind without it.
+`--allow-remote`, `--public-origin https://...`, `--trust-reverse-proxy`, and at
+least one `--trusted-proxy IP_OR_CIDR`. `ServerConfig::validate()` rejects a
+non-loopback bind without it.
 That check covers the configuration, not reality: it cannot verify that a proxy
 is actually terminating HTTPS in front of the server. Do not expose the backend
 on a public non-loopback address without TLS proxying.
 
-The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`.
+The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`, and
+must send `X-Forwarded-Proto: https`. Forwarding the public host is recommended
+for diagnostics, but the strict access check remains the `Origin` match against
+`--public-origin`.
 `--public-origin` is matched by strict equality against the request `Origin`:
 open the UI through the configured domain, not through the server IP, otherwise
 API calls are rejected with 403.