2022 Developer Survey is open! Take survey.

Hot answers tagged

44 votes
Accepted

Google .dev domain strangely redirects to https

.dev domains are HTTPS only. It isn't a redirect. It is HSTS preload. HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade ...
user avatar
9 votes
Accepted

How can I serve all resources under HTTPS instead of HTTP without changing their URLs in the HTML code

You need to drop the 'http:' prefix from all image (and any other) links on your site. When you do so, your browser will default to whatever protocol the page loads with. For example this is best: &...
user avatar
  • 2,241
9 votes
Accepted

Redirect all subdomains from one domain, to the equivalent subdomain of another domain using DNS and nginx?

You have a misconception about what DNS can do. You say, "I know I can redirect all subdomains ... using a wildcard DNS record." However, DNS can't do redirects at all. All DNS can do is point ...
user avatar
8 votes

How to block baidu spiders

I have just successfully blocked the Chinese searchbot Baiduspider from accessing any content on my site. I made the decision to do so because of the following reasons. Reasons for deciding to block ...
user avatar
8 votes

More Secure NGINX Authentication than auth_basic

Although the question is 2 years old, I would like to keep on answering to it. The page linked by the accepted answer (https://www.nginx.com/resources/wiki/modules/auth_digest/) is 11 years old and ...
user avatar
8 votes

Is it safe to use 777 for my public html folder?

Define safe. It's not a best practice. Depending on the scope of your install (e.g. who has access to the system) it may not be a big deal - for example if the only purpose of this machine is to run ...
user avatar
  • 5,825
6 votes
Accepted

Where are these spammy posts generated from?

Turns out, the WordPress install was indeed compromised. I did a diff of my existing install vs a new WordPress install, and diff reported new file: # diff -qr wordpress_installed/ wordpress_new/ ...
user avatar
6 votes

Preventing URLs ending in "/" from search engine indexes with robots.txt or rewrite rule

rewrite ^/$ ? permanent; This would only match the document root (a valid request) - this isn't a URL that ends with a slash, but a URL that starts with a slash. Try something like the following ...
user avatar
  • 4,267
6 votes
Accepted

How to stop domains from pointing to my server IP address and duplicating my site using nginx

To improve security, prevent host header attacks, and preserve your search rankings, here is what I recommend: No default site Simply drop all traffic not matching your genuine website. Before using ...
user avatar
  • 2,241
5 votes

Difference Between php_admin_value[memory_limit] and php.ini memory_limit

One difference between memory_limit = 256M in php.ini and php_admin_value[memory_limit] = 32M in pool.d/www.conf is that you can use ini_set('memory_limit','512M') to override the setting in php.ini ...
user avatar
  • 1,483
5 votes
Accepted

Rewriting image URLs in nginx from a shortened URL to a specific directory

To direct the URL domain.tld/image/filename to the local path /imageshare/images/extension/filename, use the alias directive (see this for details): location /image/ { alias /path/to/imageshare/...
user avatar
5 votes
Accepted

More Secure NGINX Authentication than auth_basic

NGINX has a digest authentication module: https://www.nginx.com/resources/wiki/modules/auth_digest/ Unlike basic authentication, digest authentication does not send user names and passwords in plain ...
user avatar
5 votes
Accepted

Is it possible for a hacker to point another domain at my domain?

Anybody can point any domain to your web server. When this happens it is usually not an attack or a security threat. It is often because some other website used to use your IP address or because ...
user avatar
4 votes
Accepted

Why do servers need to know their domain?

The main reason is: HTTP requests include the domain name. You could have stackoverflow.com and askubuntu.com all served off the same front end machine. When the server gets a request it needs to know ...
user avatar
  • 155
4 votes
Accepted

Setting up Nginx Load Balancing

Those are the backend servers that will handle the incoming request. So your domain's DNS should point to this nginx server, which will then use your upstream configuration to pass the request to one ...
user avatar
  • 241
4 votes
Accepted

Difference Between php_admin_value[memory_limit] and php.ini memory_limit

There is no difference. There are different ways to set the same PHP configuration parameter. It's useful - for example - if you have a generic php.ini which gets loaded in all PHP-FPM pools, but in ...
user avatar
  • 201
4 votes
Accepted

When I search on my domain name in a browser, the IP address is returned for my site hosted with GoDaddy and NGINX

Add this block to your NGINX config: server { listen 80; server_name here.your.ip.address; rewrite ^ http://example.com$request_uri? permanent; }
user avatar
  • 9,599
4 votes
Accepted

Getting IP address and location of my own server instead of visiting user's

Here's the Nginx Conf which works for me, placed at the path /etc/nginx/conf.d/example.com.conf. server { listen 80; listen [::]:80; server_name example.com; proxy_set_header Host $...
user avatar
4 votes
Accepted

NGINX - Rewrite .js.php file to .js

If the underlying filename is script.js.php then it doesn't make sense to rewrite this to script.js - as that would result in a 404. However, the directives you posted would seem to result in a 404 ...
user avatar
  • 41k
4 votes

How to stop domains from pointing to my server IP address and duplicating my site using nginx

It looks to me like your server is set up to redirect to HTTPS, which causes a certificate mismatch error when a visitor tries to load one of these other domains that's pointing at your IP. This is a ...
user avatar
3 votes
Accepted

Why do some Nginx configurations block download agents using Wget?

User agent wget Blocking the user agent wget will block operating systems that use wget to download files within the terminal i.e Linux, MacOS, Arm etc. This will block every file from being ...
user avatar
  • 32.6k
3 votes
Accepted

Share a configuration among different "server" directive

I think that you want to filter traffic by user agent and do something like this, in order to prevent access on some specific user agents: if ($http_user_agent ~* ^EirGrabber|PHPCrawl|PHP/5|^...
user avatar
  • 809
3 votes

How to block baidu spiders

Just decided to block Baidu as the amount of traffic it was giving us was too negligible for their aggressive scanning. In addition, they now run an agent that impersonates a browser and launches ...
user avatar
  • 269
3 votes
Accepted

Do PHP-FPM (and other PHP handlers) need execute permissions on the PHP files they're serving?

No, php-fpm user does NOT need execute permissions on PHP files. It only needs read permission, as PHP files are parsed by PHP preprocessor and not executed directly.
user avatar
  • 1,274
3 votes
Accepted

How do I get ngix to stop listening on port 80?

I will say right from the start I do not know Amazon Linux EC2, but I did do a bit of research to try and help. You should be able to stop nginx with: nginx -s stop You should be able to stop it ...
user avatar
  • 32.5k
3 votes

Should 301 redirects from www to the naked domain include the path for SEO?

The HTTP status code 301 is named "Moved Permanently": The requested resource has been assigned a new permanent URI and any future references to this resource SHOULD use one of the returned ...
user avatar
  • 21.4k
3 votes

How to block a user-agent that has a spacing in its name?

The space is a delimiter (ie. a special character) in .htaccess so must be backslash escaped if you want to match a literal space in the regex. Eg. DV\ CRAWLER. (Otherwise you are likely to get a less ...
user avatar
  • 41k
3 votes

nginx location rewrite: match /{?x}, {y}, {?z}. Remove y

If the URL contains a / followed by any characters or none followed by a / followed by sitename followed by any characters or none, remove sitename: rewrite ^(.+)/sitename(/.*)$ $1$2; ...
user avatar
3 votes
Accepted

Adding "expires" directive in Nginx conf for assets causes "404 not found" errors

location blocks are not additive. nginx selects a location block to process a request. By adding a new location block, you prevent your existing location blocks from processing the request. See this ...
user avatar
3 votes

nginx http to https redirect causing 400 Bad Request: the plain HTTP request was sent to HTTPS port

Maybe your server isn't connected via IPv6, and you only needed the standard IPv4 entries: server { listen 80; server_name example.com www.example.com; return 301 https://www.example.com$...
user avatar
  • 321

Only top scored, non community-wiki answers of a minimum length are eligible