46 votes
Accepted

Google .dev domain strangely redirects to https

.dev domains are HTTPS only. It isn't a redirect. It is HSTS preload. HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade ...
Stephen Ostermiller's user avatar
12 votes
Accepted

Redirect all subdomains from one domain, to the equivalent subdomain of another domain using DNS and nginx?

You have a misconception about what DNS can do. You say, "I know I can redirect all subdomains ... using a wildcard DNS record." However, DNS can't do redirects at all. All DNS can do is point ...
Stephen Ostermiller's user avatar
8 votes

More Secure NGINX Authentication than auth_basic

Although the question is 2 years old, I would like to keep on answering to it. The page linked by the accepted answer (https://www.nginx.com/resources/wiki/modules/auth_digest/) is 11 years old and ...
Moi Jaiunvelo's user avatar
8 votes

Is it safe to use 777 for my public html folder?

Define safe. It's not a best practice. Depending on the scope of your install (e.g. who has access to the system) it may not be a big deal - for example if the only purpose of this machine is to run ...
davidgo's user avatar
  • 7,939
7 votes

Difference Between php_admin_value[memory_limit] and php.ini memory_limit

One difference between memory_limit = 256M in php.ini and php_admin_value[memory_limit] = 32M in pool.d/www.conf is that you can use ini_set('memory_limit','512M') to override the setting in php.ini ...
Tom's user avatar
  • 1,513
7 votes
Accepted

How to stop domains from pointing to my server IP address and duplicating my site using nginx

To improve security, prevent host header attacks, and preserve your search rankings, here is what I recommend: No default site Simply drop all traffic not matching your genuine website. Before using ...
Tom Brossman's user avatar
  • 2,291
6 votes
Accepted

Where are these spammy posts generated from?

Turns out, the WordPress install was indeed compromised. I did a diff of my existing install vs a new WordPress install, and diff reported new file: # diff -qr wordpress_installed/ wordpress_new/ ...
Sathyajith Bhat's user avatar
6 votes
Accepted

Getting IP address and location of my own server instead of visiting user's

Here's the Nginx Conf which works for me, placed at the path /etc/nginx/conf.d/example.com.conf. server { listen 80; listen [::]:80; server_name example.com; proxy_set_header Host $...
Dynamic Remo's user avatar
6 votes

Preventing URLs ending in "/" from search engine indexes with robots.txt or rewrite rule

rewrite ^/$ ? permanent; This would only match the document root (a valid request) - this isn't a URL that ends with a slash, but a URL that starts with a slash. Try something like the following ...
DocRoot's user avatar
  • 4,297
5 votes
Accepted

More Secure NGINX Authentication than auth_basic

NGINX has a digest authentication module: https://www.nginx.com/resources/wiki/modules/auth_digest/ Unlike basic authentication, digest authentication does not send user names and passwords in plain ...
Stephen Ostermiller's user avatar
5 votes
Accepted

Rewriting image URLs in nginx from a shortened URL to a specific directory

To direct the URL domain.tld/image/filename to the local path /imageshare/images/extension/filename, use the alias directive (see this for details): location /image/ { alias /path/to/imageshare/...
Richard Smith's user avatar
5 votes
Accepted

Is it possible for a hacker to point another domain at my domain?

Anybody can point any domain to your web server. When this happens it is usually not an attack or a security threat. It is often because some other website used to use your IP address or because ...
Stephen Ostermiller's user avatar
4 votes
Accepted

NGINX - Rewrite .js.php file to .js

If the underlying filename is script.js.php then it doesn't make sense to rewrite this to script.js - as that would result in a 404. However, the directives you posted would seem to result in a 404 ...
MrWhite's user avatar
  • 42.8k
4 votes

How to stop domains from pointing to my server IP address and duplicating my site using nginx

It looks to me like your server is set up to redirect to HTTPS, which causes a certificate mismatch error when a visitor tries to load one of these other domains that's pointing at your IP. This is a ...
Maximillian Laumeister's user avatar
4 votes
Accepted

Reverse proxy pass websocket request with PHP in apache

That's exactly the issue. Websockets are a persistent and bi-directional connection, unlike your typical http requests. This means they don't really work with your typical HTTP tools, you need ...
Dmitriy Sokolov's user avatar
3 votes

nginx location rewrite: match /{?x}, {y}, {?z}. Remove y

If the URL contains a / followed by any characters or none followed by a / followed by sitename followed by any characters or none, remove sitename: rewrite ^(.+)/sitename(/.*)$ $1$2; ...
Richard Smith's user avatar
3 votes

How to block baidu spiders

Just decided to block Baidu as the amount of traffic it was giving us was too negligible for their aggressive scanning. In addition, they now run an agent that impersonates a browser and launches ...
Collector's user avatar
  • 269
3 votes
Accepted

Adding "expires" directive in Nginx conf for assets causes "404 not found" errors

location blocks are not additive. nginx selects a location block to process a request. By adding a new location block, you prevent your existing location blocks from processing the request. See this ...
Richard Smith's user avatar
3 votes

nginx http to https redirect causing 400 Bad Request: the plain HTTP request was sent to HTTPS port

Maybe your server isn't connected via IPv6, and you only needed the standard IPv4 entries: server { listen 80; server_name example.com www.example.com; return 301 https://www.example.com$...
drtechno's user avatar
  • 329
3 votes
Accepted

How to set up a reverse proxy on an SSL subdirectory from another server?

The visitor would never know that the subdirectory is hosted elsewhere. They are only connecting to the main server for the web page, and that's the server which serves the SSL. When the client ...
DKing's user avatar
  • 645
3 votes
Accepted

The effect of removing many URLs from google search console

Fix External Links and Setup 301 Redirects This is a 2 step approach for best effect. Set all your old links as 301 redirects. Find as many external links as you can that you can change them to the ...
Electron's user avatar
  • 314
3 votes
Accepted

nginx: 301 redirect to non-www, SSL urls on default_server(s)

The http server does not require a specific certificate, so all domains can be redirected to https non-www with a single server block. For example: server { listen 80; server_name ~^(www\.)?(...
Richard Smith's user avatar
3 votes

Nginx fails to start HTTP/2 server due to error: unknown log format

The main reason for the failure was that I had explicitly commented out log_format main. Configuring Access Logs in Nginx Under Nginx, all client requests to the server are recorded in the access log ...
Nɪsʜᴀɴᴛʜ ॐ's user avatar
3 votes
Accepted

server reached pm.max_children setting (5)

To find out the correct value, we need to find the average memory being used by one php-fpm process. Active php-fpm processes memory consumption: root@example:~# ps -eo size,pid,user,command --sort -...
st_rt_dl_8's user avatar
3 votes

Nginx PHP setup: no input file specified

The error message "No input file specified" is almost always because the value of SCRIPT_FILENAME does not point to a file. The location ~ \.php$ needs to know the document root, and the variable $...
Richard Smith's user avatar
3 votes

Detectify false positive (CVE-2013-1966 on uwsgi/nginx)?

I can't see inside the rule/logic that might actually be causing this alert so take this for what it is worth. I'm assuming they have some type of logic that detects the struts attack attempt and then ...
Jeff's user avatar
  • 31
3 votes

nginx configure error pages

This seems to be resolved with the following configuration, accepting your comments for improvement. server { server_name php.willtech.net.au; listen 80; port_in_redirect off; access_log ...
Willtech's user avatar
  • 265
3 votes
Accepted

ServerAlias directive not working on Apache 2.4.49

It looks like perhaps the <VirtualHost> containers are defined/loaded in the wrong order and requests for XX.mediawiki.wordpressinstance.example are seemingly matching the wrong vHost. The first ...
MrWhite's user avatar
  • 42.8k
3 votes
Accepted

Reverse proxy SSL with Nginx, do I need a wildcard or a separate cert for every host?

I was able to get this to work with a wildcard cert. I generated the cert with certbot using this command: sudo certbot certonly --agree-tos --email emailaddress --manual --preferred-challenges=dns -...
THE JOATMON's user avatar
3 votes
Accepted

How to modify $uri to avoid HTTP-Splitting vulnerability

The advantage of using the $request_uri variable is that unsafe characters should already be percent-encoded. The $uri variable is fully decoded which increases the risk of vulnerability when used in ...
Richard Smith's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible