reverse_proxy passes the client's Host header through to the upstream unchanged. Configurations ported from nginx often add header_up Host {upstream_hostport} out of habit, which changes behavior rather than preserving it and breaks upstream virtual-host routing.
Caddy also sets X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host automatically, appending to any existing values. Because those are appended rather than replaced, a Caddy instance exposed directly to the internet will trust and extend an attacker-supplied X-Forwarded-For. Set trusted_proxies in the reverse_proxy block, or globally with the servers option, so Caddy only honors forwarded headers from known proxy addresses; since Caddy 2.7 the trusted_proxies static form takes CIDR ranges.
When the upstream needs a specific Host, set it explicitly with header_up Host example.internal. To strip a header rather than set one, prefix the name with a minus, as in header_up -X-Forwarded-For. Health checking is off by default; health_uri and the related options enable active checks, and passive checks through fail_duration are what remove a failing upstream from rotation.