Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf www.example.com shows the wrong site, NGINX is usually doing exactly what its selection rules require: the request reached a particular address and port, but no loaded server block matched the request hostname, so NGINX used that port’s default server. The same symptom can come from DNS or IPv6 sending traffic to a different machine, or from HTTPS selecting a different TLS context before the HTTP request is processed.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Verify DNS first, inspect the configuration NGINX actually loaded, give the intended block an exact server_name on both ports 80 and 443, make the fallback explicit, then test and reload in that order.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow NGINX decides which server block receives a request
NGINX does not choose a site by the configuration filename. It first groups listening sockets by destination address and port. For HTTP, it then compares the request’s Host header with the server_name values in the blocks listening on that socket. Exact names take precedence over wildcard names, and wildcard names take precedence over regular expressions.
| Selection stage | What NGINX examines | Typical failure |
|---|---|---|
| 1. Socket | Destination IP address and port, such as port 80 or 443 | DNS points to another host, or the request reaches a different listener, load balancer, or container |
| 2. Hostname | The HTTP Host header against server_name |
www.example.com is absent, misspelled, duplicated, or covered only by an unintended wildcard |
| 3. Fallback | The default server for that address and port | An unmatched request lands on the first loaded block or on a block marked default_server |
As the NGINX documentation puts it, “In this configuration nginx tests only the request’s header field ‘Host’ to determine which server should be routed to.” If no name matches, NGINX uses the default for that listening port. The default is a property of the listen port, not of the server name: port 80 and port 443 can have different defaults.
#1 Best Overall
Configuration order matters only when no explicit default is set, or when competing names create an operational conflict. The first server block loaded for a listen socket is the implicit default. Adding default_server makes your intention visible and independent of include-file ordering.
First prove that DNS reaches this NGINX instance
Do this before editing a server block. A correct local configuration cannot affect a request that never reaches that machine. Check both the apex name and www, and check both address families.
- Query the IPv4 records:
dig +short example.com Aanddig +short www.example.com A. - Query the IPv6 records:
dig +short example.com AAAAanddig +short www.example.com AAAA. - Compare every returned address with the public addresses assigned to this NGINX host, reverse proxy, load balancer, or container ingress.
- Repeat the checks from the same network path where the problem is observed. Different resolvers, split-horizon DNS, or a stale recursive cache can produce different answers.
- Test each returned address separately. An old IPv4 record, an unexpected IPv6 record, a CDN edge, or another load balancer can serve a perfectly valid but unrelated configuration.
If www and the apex resolve to different systems intentionally, troubleshoot each system independently. If only IPv6 is wrong, clients with IPv6 connectivity may consistently see the wrong site while IPv4 tests appear fixed. Do not remove an AAAA record merely to hide the problem; first correct the destination or configure the intended listener on that address.
Inspect the configuration NGINX actually loaded
Editing a file is not proof that the running master process reads it. Distribution packages, generated configurations, and nested include directives often mean the active definition is elsewhere.
- Run
sudo nginx -T. This performs the configuration test and dumps the complete configuration, including included files. NGINX describes-Tas “same as-t, but additionally dump configuration files to standard output.” - Search the dump for every occurrence relevant to the hostname:
listen,server_name,default_server,return,rewrite, andproxy_set_header. - Record the source filename printed around each block. This lets you identify an enabled file that differs from the file you edited.
- Check whether a redirect or rewrite sends the request to another hostname before content is served. A
return 301,rewrite, or upstream response can make the symptom look like a server-selection problem.
A useful filtered view is sudo nginx -T 2>&1 | grep -nE 'listen|server_name|default_server|return|rewrite|proxy_set_header'. The full, unfiltered dump remains authoritative; filtering is only a way to find candidates quickly.
Rank #2
Declare the exact names in the intended HTTP block
Put both the apex and the www name in the block that should serve them, unless your policy deliberately separates them:
server {
listen 80;
server_name example.com www.example.com;
root /srv/www/example;
# locations or proxy_pass directives
}The exact spelling matters. A request for www.example.com will not match www.example.net, a name with a trailing typo, or a block that contains only the apex. If the application is proxied, keep the relevant proxy_pass and location directives in this same authoritative block, and verify that any upstream receives the expected host if your application relies on it.
Find competing definitions
Search the complete nginx -T output for www.example.com, not just for the filename you expect. Remove or correct an accidental duplicate exact name in another file. Also inspect broad patterns such as *.example.com and regular-expression names that could capture the request when the exact name is absent.
Exact names have priority over wildcard and regular-expression names, but duplicate exact names are still an operational problem: the effective winner depends on the loaded configuration and ordering. Keep one authoritative owner for each hostname. Disable obsolete files through the mechanism your platform uses, then confirm their absence in the next nginx -T dump.
Make the fallback deliberate
Unknown hosts should not silently receive a real site. Create a separate catch-all for each relevant port and address family. For HTTP, a minimal rejection block is:
Free tools Windows power users keep installed
One-click scans. No signup required.
server {
listen 80 default_server;
server_name _;
return 444;
}The underscore is a conventional dummy name; the important setting is default_server. This block handles requests on that socket that match no more specific name. A 444 response is an NGINX-specific connection close. If your monitoring, legal requirements, or clients need a conventional response, use an intentional 4xx status or a neutral page instead.
Do not use a catch-all redirect unless every possible destination is trusted. Redirecting an arbitrary Host value can create confusing behavior and can turn an unrecognized-host request into an open redirect. A canonical redirect should be attached to a known hostname block, not to an indiscriminate fallback.
Configure HTTPS separately and account for SNI
Port 443 needs its own correct server block. A working port-80 block does not make HTTPS correct. During the TLS handshake, the client sends the requested hostname through Server Name Indication (SNI); NGINX can select a TLS context before it processes the HTTP Host header. A wrong 443 default or a missing name can therefore present another site’s certificate, another site’s content, or both.
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# locations or proxy_pass directives
}The certificate must cover every hostname clients are expected to request. One certificate with both names in its subject-alternative-name list can serve a shared block; separate certificates require separate, correctly selected blocks. Confirm that the certificate and key files exist, are readable by NGINX, and belong together. The paths above are an example layout; use the paths shown in your loaded configuration.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →It is common to keep an HTTP block that redirects known names to HTTPS and a separate HTTPS block that serves the application. If you do that, make sure the redirect names are explicit:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://www.example.com$request_uri;
}Choose either the apex or www as canonical; do not alternate between them. If both names should serve content independently, omit the canonical redirect and ensure both are covered by the certificate and application configuration.
Validate, then reload the running master
- Run
sudo nginx -t. It checks syntax and attempts to open referenced files. Fix every reported error before proceeding. - After a successful test, reload with
sudo nginx -s reload, or use the reload operation supplied by your service manager. - Understand the distinction: a successful test validates a proposed configuration, while reload makes that configuration active. If you edit files but never reload, existing workers continue serving the old configuration.
- If reload reports an error, leave the last known-good configuration running, correct the indicated file or permission, run
nginx -tagain, and reload only after it passes.
Reload is designed to be graceful: the master starts workers with the new configuration while existing workers finish current requests. A restart is not required for an ordinary server-block correction and introduces avoidable interruption.
Test the hostname, protocol, and every DNS address
Use requests that preserve the name the user supplies. Start with normal public resolution:
Recommended Free Tools
curl -I http://www.example.com/
curl -Ik https://www.example.com/Inspect the status code, Location header, Server header, and, for HTTPS, the certificate details reported by the client. A redirect to the wrong canonical host is different from content being served by the wrong block, so record the complete redirect chain.
To test one address while preserving both the HTTP hostname and TLS SNI, use --resolve:
curl --resolve www.example.com:80:203.0.113.10 -I http://www.example.com/
curl --resolve www.example.com:443:203.0.113.10 -Ik https://www.example.com/Replace 203.0.113.10 with each address returned by DNS. The first command sends an HTTP request with the Host header for www.example.com; the second also sends that name as SNI during the TLS handshake. Comparing results across addresses reveals a stale DNS target, an inconsistent load-balancer member, or an IPv4/IPv6 split.
For a temporary, unmistakable diagnostic, add a distinctive response header only inside the intended block, for example:
add_header X-Diagnostic-Server www-block-debug always;Reload, make one request, and look for that header with curl -I. Remove the header immediately after identification; it is a debugging aid, not a permanent interface.
Use logs to prove which block handled the request
Tail the access and error logs while reproducing the request. The configured paths appear in the access_log and error_log directives shown by nginx -T; common package defaults are under /var/log/nginx/, but your deployment may use different paths or a centralized logger.
sudo tail -f /path/from-your-config/access.log /path/from-your-config/error.logMatch the timestamp, client address, request line, status, and upstream information. If no entry appears, the request probably reached another machine or an intermediary. If an entry appears in a different virtual host’s log, the request reached this NGINX but selected another block. If the intended log receives the request yet the page is wrong, inspect locations, rewrites, proxy settings, and the upstream application rather than changing server_name again.
Choose a consistent host and protocol policy
There is no universal requirement that a site use www or the apex. Decide the policy first, then implement it consistently in DNS, HTTP, HTTPS, certificates, and application-generated links.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
| Policy decision | Option | Implementation consequence |
|---|---|---|
| Canonical host | Redirect www to the apex |
Serve both names in the HTTP block, but return a permanent redirect from www; ensure the HTTPS certificate covers www so the redirect can be reached safely. |
| Canonical host | Redirect the apex to www |
Use the reverse arrangement and make www the final destination in application and cache settings. |
| Canonical host | Serve both names | Keep both exact names in the serving block and ensure cookies, redirects, and certificates intentionally support both. |
| Protocol | Redirect HTTP to HTTPS | Use explicit known names on port 80 and a matching 443 block; test the complete redirect chain. |
| Fallback | Reject unknown hosts | Use a deliberate default_server with a 4xx response or 444. |
| Deployment | Proxy, load balancer, CDN, or containers in front | Verify the front layer’s DNS, certificate, host forwarding, and backend target before changing the origin NGINX file. |
Common symptoms and the precise fix
| Symptom | Likely cause | What to check |
|---|---|---|
| HTTP shows the default site | No matching port-80 name, or the request reached another IP | DNS A/AAAA answers, nginx -T, duplicate names, and the port-80 default block. |
| HTTP is correct but HTTPS shows another certificate | Wrong 443 default, missing 443 name, or SNI selecting another context | The 443 server_name, certificate coverage, and each address with curl --resolve. |
| HTTPS certificate is correct but content is wrong | After TLS selection, the HTTP name still maps to another 443 block or a rewrite/upstream returns the content | Loaded 443 blocks, redirects, locations, proxy headers, and logs. |
| Editing a file changes nothing | The file is not included, is overridden by generated configuration, or workers were not reloaded | Source filenames in nginx -T, then nginx -t and nginx -s reload. |
| Only some users see the wrong site | Different DNS answers, stale caches, IPv6 divergence, or inconsistent front-end nodes | Compare every A and AAAA result and test each address from the affected network. |
Adding a wildcard did not fix www |
A duplicate exact name, an unexpected default, or a different destination is involved | Search all exact, wildcard, and regex definitions and confirm the request’s destination IP. |
A safe change checklist
- Confirm the apex and
wwwA and AAAA records point to the intended service. - Identify whether a load balancer, CDN, reverse proxy, or container ingress terminates TLS or forwards the request.
- Capture the effective configuration with
sudo nginx -T. - Keep one authoritative exact
server_nameowner for each hostname on each required port. - Configure port 80 and port 443 independently, including certificate files and SNI coverage.
- Set an intentional
default_serverfor unmatched requests. - Run
sudo nginx -tand fix syntax, include, certificate, and permission errors. - Reload with
sudo nginx -s reloadonly after the test succeeds. - Test public DNS and every returned address with normal requests and
curl --resolve. - Use access and error logs to confirm the selected block, then remove any temporary diagnostic header.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
