7

I recently created an Ubuntu server and installed LEMP stack after which I hosted my website on the server using WordPress.

But after sometime, I notices some domains ranking in Google and loading my website.

Is there any way through which I can stop them from doing this?

Previously, I never faced such issue.

For reference: My main domain: https://droidmaze.com

Other domains (not mine) pointing to my server I.P.:

http://tirtadji.com/
http://www.pisonlifetree.com

I am concerned that this can penalize my website for duplicate content.

Improve this question
3
  • You can't prevent somebody from pointing a domain at your IP address. All you can do is reconfigure your server to respond appropriately rather than showing your site.
    – Stephen Ostermiller ♦
    Commented Sep 3, 2020 at 0:52
  • 1
    According to a DNS lookup on these domains they are not "pointing to your server's IP address"? Was that an assumption or has this been changed? If a malicious site wanted to "clone" another site they would most probably configure a reverse proxy - which would need to be explicitly blocked. Simply pointing a domain to a server's IP address won't work in most cases, as a "correctly" configured server would not accept such requests (as @StephenOstermiller suggests). (Your main domain is failing to connect for me?)
    – MrWhite
    Commented Sep 3, 2020 at 12:07
  • @MrWhite Actually, I fixed the issue.
    – w3Abhishek
    Commented Sep 3, 2020 at 14:25

4 Answers 4

Reset to default
7

To improve security, prevent host header attacks, and preserve your search rankings, here is what I recommend:

No default site

Simply drop all traffic not matching your genuine website. Before using the below config, execute the following example command on your server to generate self-signed "dummy" certificates which are necessary for responding to HTTPS requests.

mkdir /etc/ssl/dummy && openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ssl/dummy/dummy.key -out /etc/ssl/dummy/dummy.crt

Now use the following two server blocks for your default site configuration.

server {
    listen [::]:80 default_server;
    listen      80 default_server;
    return 444;
}

server {
    listen     [::]:443 ssl http2 default_server;
    listen          443 ssl http2 default_server;
    ssl_certificate           /etc/ssl/dummy/dummy.crt;
    ssl_certificate_key       /etc/ssl/dummy/dummy.key;
    return 444;
}

Reload Nginx and it will drop all the copycat site connections.

Prevent framing

Somewhere in your genuine site's server block, add the following header to prevent someone embedding your site as a frame / iframe at their domain name.

add_header X-Frame-Options "SAMEORIGIN";

Canonical URLs

In the <head> section of every page, add a canonical URL link element. If every page has something like <link rel="canonical" href="https://www.your-site.com/your-page/"> then even if someone copies your site at their domain name, search engines recognise your site as the original.

Improve this answer
5
  • There is no such thing as an HTTP 444 error. That appears to be a nginx specific directive to close the connection without sending a response. It would be friendlier to send a HTTP response with a 404 error letting users know that the site wasn't found.
    – Stephen Ostermiller ♦
    Commented Sep 4, 2020 at 9:52
  • 3
    > There is no such thing as an HTTP 444 error. No one claimed there was, Stephen. However it is a great way to drop scammy connection attempts (with minimal resources). You have no obligation to be nice to people copying your content, and my answer takes this into account. You wouldn't stop and explain to a phone scammer that it wasn't right to do that, would you? No, you would simply terminate the connection by hanging up. That's what Nginx 444 does for you and I think it's perfect for this use case.
    – Tom Brossman
    Commented Sep 4, 2020 at 10:12
  • 1
    In my experience domains pointing at my IP address have not been malicious. Most of the time somebody has something misconfigured or I get an IP address that had been used by somebody else. Error messages can help not just the owner of the other domain, but visitors as well. A 404 error isn't resource intensive. The HTTP spec doesn't say that connections can be closed and dropped like that as far as I know.
    – Stephen Ostermiller ♦
    Commented Sep 4, 2020 at 10:38
  • "generate self-signed "dummy" certificate" - if you don't do this, presumably the connection will just "fail"?
    – MrWhite
    Commented Sep 4, 2020 at 15:16
  • Nginx requires the dummy certs to be present before it will start/restart. This is because TLS encapsulates the HTTP connection, so the handshake has to happen before the HTTP response. It seems silly, but is technically correct.
    – Tom Brossman
    Commented Sep 4, 2020 at 15:51
4

It looks to me like your server is set up to redirect to HTTPS, which causes a certificate mismatch error when a visitor tries to load one of these other domains that's pointing at your IP. This is a good thing, as reputable browsers and crawlers will see the certificate mismatch and know not to "count" the content in favor of the other domains, or in the case of a browser a warning page will be shown. You should already not have to worry about any crawler issues.

If you want to take this a step further, consider configuring your server to redirect all visitors directly to your own domain. Then, whoever visits those domains will be seamlessly redirected to your own domain. This makes it even more of a "them" problem.

A default virtual server something like this could work, since you have your question tagged nginx:

server {
    listen 80 default_server;
    server_name _;

    return 301 https://droidmaze.com$request_uri;
}
Improve this answer
2
  • I already added the return 301 in nginx config file but it still doesn't redirect when homepage is open. Only the blog posts are getting redirected to my website.
    – w3Abhishek
    Commented Sep 3, 2020 at 0:55
  • I usually recommend that servers show a 404 page for unrecognized domains rather than redirect. I'd replace the return 301 https... with return 404. To provide a custom 404 page with a message like "This server is not configured for this domain name" see How to get nginx to always return a custom 404 for the default host
    – Stephen Ostermiller ♦
    Commented Sep 3, 2020 at 0:56
1

If you are familliar with php and feels comfortable editing files then adding a custom a code in index.php will do the trick just fine.

here what i should use in my index.php file after php open tag(<?php) ofcourse replace mydomain.tld to your real domain name.

if (!isset($_SERVER['HTTP_HOST']) != 'mydomain.tld')die("Domain not authorised");

Refer here https://stackoverflow.com/a/1459794/14214571 for another code example.

Improve this answer
4
  • 2
    Can you explain a little more about how the OP might use the link and PHP to solve their issue with nginx? Thanks.
    – dan ♦
    Commented Sep 4, 2020 at 7:41
  • @dan it's simple we can add a breaker with if, like if (!isset($_SERVER['HTTP_HOST']) != 'hisdomain.tld')die("Domain not authorised"); something like that would do the trick without any issues
    – Ankit Y.
    Commented Sep 4, 2020 at 14:54
  • @AnkitY. You need to add the relevant information to your answer. Link-only answers are considered "low quality" as the link target might be deleted or at the very least requires the user to visit another site. (Comments are not strictly part of the answer and are not indexed.) Yes, the link is another site on the SE network, however, the same applies. At most, this is no more than a comment.
    – MrWhite
    Commented Sep 4, 2020 at 15:08
  • 1
    @dan i get i will be carefull from now on about answering something.
    – Ankit Y.
    Commented Sep 4, 2020 at 15:13
1

I had this problem. Some sc###ag was my DNS for their server, there was a real danger visitors might attempt to sign in or sign up. I added the following NGINX rule, right at the bottom of the server section. The rule checks to ensure that the domain making the request is "my" domain - if it's not then it redirect the user to the correct domain.

Sure, it's a bit blunt but it worked a treat.

if ($http_host != 'my-domain-name.com'){
            return 301 https://my-domain-name.com;
            }

I also followed the recommendations on this page: https://www.marksayson.com/blog/setting_http_security_headers_in_rails/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.