Choose one canonical origin—https://www.example.com in the examples below—and send every other scheme and hostname directly to it. On Nginx, use dedicated redirect server blocks with return 301 and $request_uri. On Apache, prefer a port-80 virtual host with Redirect permanent; use the .htaccess rewrite only when you cannot edit virtual-host configuration. The finished setup should make three common variants return one redirect, preserve the path and query string, and serve the fourth variant without redirecting.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the canonical redirect should do
A canonical URL has one scheme and one hostname. In this guide the canonical origin is https://www.example.com. These requests are therefore non-canonical:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
http://example.comhttp://www.example.comhttps://example.com
Each non-canonical request should point directly to the HTTPS www URL. Do not first redirect HTTP to HTTPS and then redirect the bare hostname to www; that creates an avoidable two-hop chain. A request for https://www.example.com should reach the application without a redirect.
| Incoming request | Expected result |
|---|---|
http://example.com/path?x=1 |
One permanent redirect to https://www.example.com/path?x=1 |
http://www.example.com/path?x=1 |
One permanent redirect to https://www.example.com/path?x=1 |
https://example.com/path?x=1 |
One permanent redirect to https://www.example.com/path?x=1 |
https://www.example.com/path?x=1 |
Application content, with no redirect |
The path must remain /path, and the query string must remain ?x=1. A redirect that drops either can break deep links, tracking parameters, downloads, or API clients.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites before changing the server
- DNS: Both
example.comandwww.example.commust resolve to the service that will issue the redirect or serve the site. Include the relevant IPv4 and IPv6 records if your deployment uses both. - TLS certificates: The canonical HTTPS virtual host needs a certificate valid for
www.example.com. The HTTPS bare-host redirect also requires a certificate valid forexample.com, because TLS negotiation happens before the server can return a redirect. If clients can reach another hostname over HTTPS, that name needs coverage as well. - Configuration access: The Nginx recipe assumes access to the main server configuration. The preferred Apache recipe assumes access to virtual-host configuration; the
.htaccessvariant is a fallback for managed hosting. - One owner for redirects: Decide whether Nginx/Apache, a reverse proxy, or a CDN is authoritative. If two layers each rewrite the host or scheme, they can create loops or extra hops.
Choose the canonical host deliberately
Decide on the public origin before writing a rule. Apache’s canonical-host guidance recommends selecting one hostname and redirecting alternate names to it. Here, that decision is www.example.com over HTTPS. The same approach works if your organization chooses the bare hostname instead; change every target and condition consistently rather than mixing policies.
Use a literal target in redirect rules. A literal hostname makes the result predictable for browsers, crawlers, caches, and security controls. It also avoids turning an untrusted Host header into an open redirect. If a CDN, load balancer, or ingress controller owns the public hostname, document that ownership and ensure the origin follows the same policy instead of applying a competing rewrite.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNginx configuration
Nginx’s canonical-host pattern uses a separate server for the name that should redirect. Put the redirect in a server context rather than trying to fold it into application rewrite rules. The examples below send both HTTP names to the canonical HTTPS www origin and separately handle HTTPS requests for the bare hostname.
1. Redirect HTTP requests
server {
listen 80;
server_name example.com;
return 301 https://www.example.com$request_uri;
}
server {
listen 80;
server_name www.example.com;
return 301 https://www.example.com$request_uri;
}Replace example.com with the real domain. Keeping the two names in separate blocks makes the intended host mapping explicit and follows Nginx’s documented canonical-host approach. The return directive is valid at server level, so no location-level rewrite is needed.
Nginx selects a server block using the listening address and port, then the requested name. Keep the redirect blocks on every address clients can use, including IPv6 if you listen there. Do not assume that an unlisted hostname will be handled safely by whichever block happens to be first; define a deliberate default server when you need controlled handling for unknown names.
2. Redirect HTTPS on the bare hostname
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/certificate.pem;
ssl_certificate_key /path/to/private-key.pem;
return 301 https://www.example.com$request_uri;
}This block is essential for https://example.com/... requests. It must complete TLS with a certificate that covers example.com, then issue the redirect. Without a matching certificate, a browser can stop on a certificate error before Nginx has an opportunity to redirect.
Recommended Free Tools
If you use separate certificate files for the two names, install the correct chain and key in each TLS server block. A wildcard or multi-name certificate can cover both, but the certificate’s subject alternative names must actually include every hostname that clients request.
3. Serve the canonical HTTPS site
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /path/to/certificate.pem;
ssl_certificate_key /path/to/private-key.pem;
# application locations ...
}Place your normal application locations, proxy settings, static-file root, and other site directives in this block. The certificate presented here must include www.example.com.
Why $request_uri preserves links
Nginx’s $request_uri variable contains the original URI, including the path and query string. Thus a request for /products/item-7?ref=mail is redirected to https://www.example.com/products/item-7?ref=mail. Do not replace it with only a hard-coded slash if deep links must survive.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Keep the variable immediately after the canonical host, as shown. Test encoded characters, an existing trailing slash, an empty query, and repeated parameters. Those cases expose accidental escaping or concatenation errors that a test of the home page will not reveal.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Handling unexpected hostnames safely
A request can arrive with a hostname you did not configure. If you need to catch such traffic, add a deliberate default server that returns a controlled response or a known redirect. Do not construct a redirect by reflecting an arbitrary Host header; an attacker can supply an untrusted host value and turn that into an open-redirect or confusing cache behavior. Keep the canonical target literal.
Validate and reload Nginx
- Save the server blocks in the configuration included by your Nginx installation.
- Run
nginx -tand correct every syntax or certificate-path error before reloading. - Reload the service using your platform’s service manager, for example
systemctl reload nginx. A reload applies the new configuration without deliberately stopping existing workers. - Test each hostname from a client that resolves to this server. If a CDN or load balancer sits in front, test through that public path as well as directly against the origin where possible.
Apache virtual-host configuration
Apache’s preferred HTTP-to-HTTPS solution is a dedicated port-80 virtual host using Redirect permanent, not a rewrite rule. Serve the canonical content from a separate port-443 virtual host. Add a second TLS virtual host for the bare name so HTTPS requests can be redirected after certificate negotiation.
1. Redirect both HTTP names from port 80
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
Redirect permanent / https://www.example.com/
</VirtualHost>Redirect permanent sends a permanent redirect (HTTP 301). With a root target of https://www.example.com/, Apache appends the requested path, so /docs/setup becomes https://www.example.com/docs/setup. The original query string is retained by the redirect mechanism. Confirm the behavior with the exact paths and parameters your application uses.
Putting both names in this port-80 virtual host ensures that neither HTTP variant is first redirected to a different HTTPS hostname. If other port-80 virtual hosts exist, verify that the request’s ServerName or ServerAlias selects this block and that an earlier default host is not intercepting it.
2. Redirect HTTPS on the bare name
<VirtualHost *:443>
ServerName example.com
SSLEngine on
SSLCertificateFile /path/to/certificate.pem
SSLCertificateKeyFile /path/to/private-key.pem
Redirect permanent / https://www.example.com/
</VirtualHost>The certificate in this virtual host must be valid for example.com. Apache cannot issue an HTTPS redirect until the TLS handshake has succeeded.
The redirect is intentionally in its own TLS virtual host rather than in the canonical site’s application rules. This keeps the host decision clear and prevents the bare name from accidentally serving duplicate content when a redirect was intended.
3. Serve the canonical HTTPS site
<VirtualHost *:443>
ServerName www.example.com
SSLEngine on
SSLCertificateFile /path/to/certificate.pem
SSLCertificateKeyFile /path/to/private-key.pem
DocumentRoot /var/www/example
# application configuration ...
</VirtualHost>Use the appropriate certificate chain and application directives for your installation. Ensure the www virtual host is selected for requests whose SNI name is www.example.com.
Validate and reload Apache
- Enable the required SSL and rewrite modules only if your chosen configuration needs them;
Redirectitself is provided by Apache’s alias module. - Run your platform’s configuration check, such as
apachectl configtest, and fix errors before reloading. - Reload the service (for example,
systemctl reload apache2orsystemctl reload httpd, depending on the distribution). - Check the active virtual-host mapping if a request reaches the wrong site. A duplicate
ServerNameor an earlier default virtual host can capture traffic unexpectedly.
Apache .htaccess fallback
Use this only when the hosting environment does not let you edit the main virtual-host configuration. The directory containing the file must permit overrides, and mod_rewrite must be enabled.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]%{HTTPS} is on for an SSL/TLS connection. The rule redirects when the request is not HTTPS or when the host is not the canonical www name. The substitution is fully qualified, so Apache emits an external redirect. %{REQUEST_URI} carries the path; because the substitution does not add a new query string, Apache keeps the original query string.
The R flag selects an external redirect and R=301 makes it permanent. Pair it with L so processing stops after the redirect; otherwise later rewrite rules can run and produce another redirect or alter the target. Adapt the host condition if your canonical domain differs. If a reverse proxy terminates TLS, make sure Apache receives a trustworthy indication of the original scheme; otherwise it may believe every request is HTTP and redirect forever.
Because .htaccess rules run in directory context, the rule is evaluated after Apache has selected a virtual host and mapped the request into a directory. That makes it less direct than a virtual-host redirect and can add per-request processing. Do not deploy both an equivalent virtual-host redirect and this fallback without testing; duplicate rules can create an extra hop or a loop.
Redirects behind a CDN or load balancer
Trace the complete request path before deciding where the rule belongs. A client may connect to a CDN over HTTPS while the CDN connects to the origin over HTTP. If the origin checks only its local connection and ignores the proxy’s trusted original-scheme signal, it can redirect an already secure public request repeatedly. Configure one authoritative scheme header at the proxy and make the origin trust it only from that proxy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Similarly, decide whether the edge or origin performs host canonicalization. If the edge changes example.com to www.example.com and the origin then applies another host rule, the response may contain two redirects even though each layer appears correct in isolation. Validate both the public URL and a direct origin path, while remembering that direct-origin behavior can differ from what visitors see through the CDN.
Preventing redirect chains
Each non-canonical variant should target the final URL in one step. A common mistake is an HTTP rule that points to https://example.com, followed by a host rule that points to https://www.example.com. That works functionally but adds latency and exposes clients and crawlers to an unnecessary intermediate URL. Put the complete scheme and hostname in every redirect target.
| Variant | Expected HTTP status | Expected Location |
|---|---|---|
http://example.com/path?x=1 |
301 | https://www.example.com/path?x=1 |
http://www.example.com/path?x=1 |
301 | https://www.example.com/path?x=1 |
https://example.com/path?x=1 |
301 | https://www.example.com/path?x=1 |
https://www.example.com/path?x=1 |
2xx (or the application’s normal response) | No redirect |
How to test the finished setup
Use a request that does not automatically follow redirects first, so you can inspect each hop:
curl -sS -D - -o /dev/null 'http://example.com/path?x=1'
curl -sS -D - -o /dev/null 'http://www.example.com/path?x=1'
curl -sS -D - -o /dev/null 'https://example.com/path?x=1'
curl -sS -D - -o /dev/null 'https://www.example.com/path?x=1'For the first three commands, check that the response is 301 and that Location is exactly the canonical HTTPS www URL with the same path and query. For the fourth, check that there is no Location header redirecting elsewhere. Then test a path containing URL-encoded characters, a trailing slash, and multiple query parameters; these reveal escaping or query-string mistakes that a root-page test can miss.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTo see whether a client experiences more than one hop, use:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
curl -sS -L -o /dev/null -w '%{url_effective} %{http_code}n' 'http://example.com/path?x=1'The final URL should be the canonical origin. A verbose request (curl -v) is useful when diagnosing certificate selection, DNS, or proxy behavior, but avoid pasting private keys or authorization headers into support logs.
Choosing a redirect status
301 for a permanent canonical URL
Use 301 when the HTTP-to-HTTPS and hostname choice is intended to be permanent. Apache’s rewrite R flag accepts symbolic or numeric statuses, including R=301; a fully qualified replacement produces the external redirect used here. Browsers and intermediaries may cache a 301, so test the rule carefully before deploying it broadly.
When 307 or 308 deserves consideration
Some APIs and clients depend on preserving the request method and body. Evaluate 307 (temporary) or 308 (permanent) for those endpoints and test the actual client behavior before publishing a permanent policy. The canonical-host recipes above use 301 because they describe a permanent URL change; no single status is correct for every application protocol.
Troubleshooting common failures
The browser reports a certificate warning instead of redirecting
The request is reaching HTTPS before the redirect logic can run. Install a certificate that covers the hostname the client requested—example.com for the bare-host redirect and www.example.com for the canonical site—and verify that the correct TLS virtual host is selected.
There is an infinite redirect loop
Inspect which layer terminates TLS. If a CDN or load balancer forwards an HTTP request to the origin after the client used HTTPS, an origin rule based only on the internal connection can repeatedly redirect. Configure the proxy’s scheme forwarding and Apache/Nginx trusted-proxy handling consistently, then test through the public endpoint. Also ensure the canonical www HTTPS block serves content rather than matching a redirect block.
The path or query string disappears
On Nginx, use $request_uri in the target. On Apache, keep the root target in Redirect permanent or use %{REQUEST_URI} in the fallback rewrite. Check whether another proxy or application rule rewrites the URL after the web server has issued its response.
Requests still land on the bare hostname
Confirm that both HTTP and HTTPS bare-host listeners exist, that DNS for the bare name reaches them, and that the certificate allows the HTTPS request to complete. On Apache, check for a duplicate ServerName; on Nginx, check which server block is the default for the address and port.
Only some clients fail after switching to 301
Older clients, API libraries, and caches can handle redirect statuses differently. Reproduce the request with the client that fails, inspect whether it follows 301 and whether it preserves the method, and consider 307 or 308 where method preservation is a requirement. Clear local cached redirects only after the server response is correct.
Deployment checklist
- Canonical origin is explicitly set to
https://www.example.com. - Both DNS names resolve to the redirecting or serving infrastructure.
- Certificates cover every HTTPS hostname that must answer, including the bare name.
- Nginx has separate redirect blocks and a canonical TLS block, or Apache has dedicated virtual hosts.
- Every non-canonical target includes the final scheme and hostname, avoiding a two-step chain.
- Paths and query strings are preserved.
- Configuration syntax checks pass before reload.
- All four URL variants have been tested without automatically following redirects.
- The canonical HTTPS URL serves the application directly and does not redirect again.
- Any CDN, proxy, or TLS terminator agrees with the origin’s scheme and host policy.
Once these checks pass, visitors, crawlers, and API clients have one stable URL for every resource, while legacy HTTP and bare-host links continue to reach the same path on the canonical HTTPS site.
Frequently Asked Questions
Do I need a certificate for the bare domain if it only redirects to www?
Yes. For an https://example.com request, TLS negotiation happens before Nginx or Apache can send a redirect. The certificate presented by the bare-host TLS virtual host must cover example.com; the canonical virtual host must cover www.example.com.
Will the redirect keep query parameters and deep-link paths?
Yes, when configured as shown. Nginx uses $request_uri, which includes the path and query string. Apache’s Redirect permanent / https://www.example.com/ appends the requested path and retains the original query string. Verify with a URL such as /download/file.zip?token=abc.
Why use separate Nginx server blocks instead of one rewrite rule?
Nginx documents a separate server for the hostname that should redirect as the canonical-host pattern. It keeps redirect traffic out of the application server block and makes host matching explicit. Use a deliberate default server for unexpected names instead of reflecting an arbitrary Host header.
Is .htaccess acceptable for this redirect?
It is a fallback when you cannot edit Apache’s virtual-host configuration. The directory must allow overrides and mod_rewrite must be enabled. Apache’s preferred approach is a dedicated port-80 virtual host with Redirect permanent, which avoids per-directory rewrite processing.
Should I use 301, 307, or 308?
Use 301 when the canonical URL choice is permanent and ordinary browser navigation is involved. If an API or client must preserve the request method and body, evaluate 307 or 308 and test that client’s behavior before making the policy permanent.
How can I tell whether a CDN is causing a redirect loop?
Inspect the scheme seen at each layer. If the CDN accepts HTTPS but connects to the origin over HTTP and the origin does not trust a correct original-scheme signal, the origin may redirect repeatedly. Make one layer authoritative, configure trusted scheme forwarding, and test through the public endpoint.
What should happen for an unknown hostname sent to my IP address?
Define a deliberate default server or virtual host that returns a controlled response or a known, literal redirect. Do not build the destination from the incoming Host header, because an attacker can supply an untrusted value.
The Bottom Line
Choose one literal canonical origin, give every HTTPS hostname a valid certificate, and send all three non-canonical variants directly to https://www.example.com. Nginx should use separate server blocks with return 301 ...$request_uri; Apache should use dedicated virtual hosts with Redirect permanent whenever possible. Validate syntax, test every scheme/host combination through the real proxy path, and confirm that paths, queries, methods, and certificates behave as intended.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
