A normal proxy acts for the user, fetching sites on their behalf. A reverse proxy acts for the website: visitors talk to the proxy, and the proxy talks to the real application server, which they never contact directly. Nginx, Apache, HAProxy and the edge networks of CDN companies all do this job.
It is used for several reasons: terminating HTTPS, caching responses, compressing content, balancing load, hiding the internal layout and filtering bad requests. A WAF is often built into a reverse proxy.
The arrangement has side effects that matter for security. The backend sees the proxy's address and not the visitor's unless it is told through a header such as X-Forwarded-For, so logs and IP allow lists can be wrong if they are not set up with that in mind. The proxy and the backend may also disagree about where a request starts and ends, which is the cause of request smuggling bugs.
Make sure the backend only accepts traffic from the proxy, and keep the proxy's limits and the application's limits consistent.