The reliable production pattern is to terminate TLS at Nginx on your VPS, proxy encrypted requests to Gunicorn or Uvicorn, and configure Django to trust the HTTPS signal only when Nginx sets it correctly. Point your domain to the VPS, open TCP ports 80 and 443, obtain a certificate with Certbot (or another ACME client), redirect HTTP to HTTPS, then enable Django’s secure-cookie and redirect protections.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This arrangement keeps Django’s development server off the public internet, protects credentials and session data, and gives you a clear renewal and rollback path. The instructions below assume a Linux VPS, a domain you control, Nginx as the reverse proxy, and an application already running behind Gunicorn or Uvicorn.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the finished deployment looks like
A browser connects to https://example.com. Nginx accepts the connection on port 443, proves the site’s identity with the certificate, and forwards the request over the local socket or localhost port to Gunicorn or Uvicorn. Django handles the request without needing to manage public TLS itself.
Port 80 remains useful for two jobs: ACME HTTP-01 certificate validation and a permanent redirect to the HTTPS URL. Do not run Django’s development server directly on either public port.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Layer | Responsibility |
|---|---|
| DNS | Resolves the site’s A and, if used, AAAA records to the VPS address. |
| Firewall | Allows inbound TCP 80 and 443 through both the VPS and provider firewalls. |
| Nginx | Terminates TLS, serves the certificate, redirects HTTP, and proxies requests. |
| Certbot or another ACME client | Requests, stores, renews, and (when configured) deploys certificates. |
| Gunicorn or Uvicorn | Runs the Django application on a Unix socket or localhost port. |
| Django | Validates hosts, understands the trusted HTTPS header, and marks cookies and redirects as secure. |
Before changing anything
Confirm the production components
- Record the exact public hostname, including any
wwwvariant you intend to serve. - Record the VPS public IPv4 address and any IPv6 address.
- Identify the systemd service (or other supervisor) that runs Gunicorn or Uvicorn.
- Find the active Nginx site file and note whether the upstream is a Unix socket such as
/run/gunicorn.sockor a localhost port such as127.0.0.1:8000. - Keep the application source, virtual environment, static files, and media paths unchanged while you make the proxy change.
Django’s development server is not a production edge server. It is not designed to provide the operational isolation, TLS handling, logging, or process supervision needed on an internet-facing VPS.
Back up the current configuration
Copy the active Nginx site configuration and the main Nginx configuration to a root-only backup location. Save the current Django settings and record service status before editing. A configuration backup lets you restore the previous working HTTP path if a certificate request or proxy reload fails.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check DNS first
Every hostname on the certificate must resolve to the VPS that will answer the ACME challenge. Verify both record families if you publish both:
- An
Arecord should point to the VPS IPv4 address. - An
AAAArecord should point to a reachable VPS IPv6 address. Remove an incorrect AAAA record or fix IPv6 routing; an ACME validator may prefer IPv6 and fail even when IPv4 works.
Test the application by its intended hostname before requesting a certificate. If DNS still points at an old server, changing Nginx on this VPS cannot make validation succeed.
Open the required ports
Allow inbound TCP 80 and 443 in the operating-system firewall and in any separate firewall supplied by the VPS provider. HTTP-01 validation normally requires port 80 to be reachable from the public internet. Restrict SSH separately to the addresses or access method you use; do not solve an HTTPS problem by exposing unrelated ports.
Obtain a certificate with Certbot
Choose the challenge method
Certbot’s Nginx integration can request a certificate and edit the Nginx configuration for you. It is convenient when Nginx is already serving the hostname and the HTTP challenge path can reach this VPS. Certbot’s standalone mode temporarily runs its own validation server and therefore also needs port 80 available; stop or reconfigure the service that occupies that port only for the documented validation window.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIf HTTP-01 cannot reach the VPS—for example, because the service is behind a firewall or the DNS design does not allow a public HTTP listener—use DNS-01 with an ACME client that can create the required DNS record. DNS-01 changes the validation requirement; it does not remove the need to configure Nginx to serve the resulting certificate.
Install and request through the Nginx plugin
Install Certbot and its Nginx plugin using your Linux distribution’s supported packages. Then request the names you actually serve, for example:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo certbot --nginx -d example.com -d www.example.comFollow the prompts for an administrative email and the certificate authority’s terms. Choose the redirect option only after confirming that the HTTP site and challenge path are reachable. Certbot normally places active certificate material under /etc/letsencrypt/live/. Protect the private key and do not copy certificate files into your application repository, container image, or a world-readable directory.
If you prefer to keep Nginx edits manual, use Certbot only to obtain the certificate and reference the resulting live paths in the 443 server block. The live directory is designed to remain stable while Certbot updates its target files during renewal.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesConfigure Nginx as the TLS terminator
Create an HTTPS server block
The exact include paths differ by distribution, but the server block needs the same elements: the hostname, port 443 with TLS enabled, the certificate and key paths, an upstream, and headers that preserve the original request details.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location /static/ {
alias /srv/example/static/;
}
location /media/ {
alias /srv/example/media/;
}
location / {
proxy_pass http://unix:/run/gunicorn.sock;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}Replace the socket, aliases, and hostnames with your deployment’s real values. If Gunicorn or Uvicorn listens on localhost instead, use a value such as proxy_pass http://127.0.0.1:8000;. The Host header lets Django apply ALLOWED_HOSTS to the public hostname. The forwarded-for header preserves the client chain for logging and application logic.
Set X-Forwarded-Proto https in the TLS server block because those requests arrived through HTTPS. Do not send that value unconditionally from a listener that also accepts plain HTTP. Django can make a security decision from this header only when the proxy controls it reliably.
Redirect the HTTP server block
Use a separate port-80 block that does not proxy an unencrypted request to Django:
Recommended Free Tools
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}This front-end redirect is preferred for performance because Nginx handles it before the request reaches Python. Keep port 80 reachable for HTTP-01 validation; Certbot may temporarily add or use a challenge location during issuance or renewal.
Test and reload safely
- Run
sudo nginx -t. Do not reload if the syntax test reports an error. - Reload Nginx with your distribution’s service command, commonly
sudo systemctl reload nginx. - Restart or reload Gunicorn/Uvicorn only when its configuration or application code changed. A certificate-only change normally needs the Nginx reload, not an application restart.
- Inspect Nginx’s error log and the application service log for upstream socket permissions, missing files, certificate access, or hostname errors.
Keep the previous site file available until HTTPS has passed functional checks. A failed reload leaves the old worker configuration running on many systems, but you should verify rather than assume that behavior.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Set Django’s production security settings
Allow only the real hostnames
Set ALLOWED_HOSTS to the names users can send in the Host header. Avoid a wildcard unless you have a specific, controlled reason:
ALLOWED_HOSTS = [
"example.com",
"www.example.com",
]Use the same spelling in DNS, Nginx, certificate names, redirects, and links generated by the application. Inconsistent hostnames are a common cause of failed CSRF checks and confusing redirects.
Free tools Windows power users keep installed
One-click scans. No signup required.
Tell Django which proxy signal is authoritative
When Nginx is the only trusted proxy and it sets the header exactly as shown above, add:
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")Django will then treat a request as secure when the header value is https. This setting is safe only when an untrusted client cannot inject or preserve that value through your proxy chain. If another load balancer sits in front of Nginx, document which layer overwrites the header and configure trust accordingly. A stale or forged header can create security problems; a missing header can produce redirect loops.
Enable redirects and secure cookies
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = TrueSECURE_SSL_REDIRECT adds an application-level safeguard when a request reaches Django without the secure flag. If Nginx already redirects every HTTP request, the proxy remains the fastest enforcement point, while Django’s setting protects against an unexpected plain-HTTP path. Do not enable it until the proxy’s HTTPS signal is correct, or every request can redirect forever.
The two cookie settings prevent session and CSRF cookies from being sent over plain HTTP. They do not encrypt a page’s other resources, so templates, JavaScript, API clients, and stored content must also use HTTPS URLs.
Declare HTTPS origins for CSRF-protected requests
If your deployment uses explicit CSRF origin checking, include the HTTPS origins that submit forms:
CSRF_TRUSTED_ORIGINS = [
"https://example.com",
"https://www.example.com",
]Use complete origins with the scheme. Include only hosts you control and actually need. A mismatch between the browser’s origin, the form action, and this list can make login or other POST requests fail after the certificate is installed.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Add HSTS only after HTTPS is stable
HTTP Strict Transport Security tells browsers to use HTTPS automatically for a period you specify. It is powerful but can make recovery difficult if the certificate, redirect, or subdomain policy is wrong. First verify every required hostname, static URL, media URL, and administrative path over HTTPS. Then choose HSTS settings deliberately, understand whether subdomains are included, and avoid preload-related options until you have reviewed their long-term consequences.
Verify the complete request path
Check the redirect and certificate
- Request the HTTP URL and confirm it returns a permanent redirect to the equivalent HTTPS URL, preserving the path and query string.
- Open the HTTPS URL and confirm the certificate covers the hostname the browser is using. Test both apex and
wwwnames if both are published. - Confirm that the certificate served on port 443 is the newly installed one, not an older certificate from another server block.
- Check an IPv6 connection separately when an AAAA record exists; a working IPv4 path does not prove that IPv6 reaches the same Nginx instance.
Check Django behavior
- Sign in and verify that the session cookie has the
Secureattribute. - Submit a CSRF-protected POST, such as a login or profile form.
- Inspect browser developer tools for mixed-content warnings. Replace absolute
http://URLs in templates, settings, JavaScript, CSS, and stored content. - Confirm that Django no longer reports an insecure request when the browser is using HTTPS.
- Run Django’s deployment checks with the same production settings used by the service. Address warnings rather than assuming the certificate alone completes the deployment.
Check static and media files
Static and media responses may be served directly by Nginx or proxied to Django. Either way, the page must reference them with HTTPS-compatible URLs. A secure document that loads a script, stylesheet, image, font, or API endpoint over HTTP can trigger mixed-content blocking even though the certificate itself is valid.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set up and test automatic renewal
A certificate is useful only if renewal and deployment are reliable. Certbot commonly installs a systemd timer or cron job, depending on the operating system and package. Confirm that the scheduled job exists, is enabled, and can run with the permissions needed to write under /etc/letsencrypt/.
- Inspect the Certbot timer or cron entry supplied by your package.
- Run the client’s safe renewal test command according to its documentation. A dry run should exercise the challenge and renewal workflow without replacing the live certificate.
- Confirm that a successful renewal triggers an Nginx reload or another deploy hook. Updating files under
/etc/letsencrypt/live/does not help a running Nginx worker if it never reloads the new certificate. - After a test or real renewal, inspect the certificate actually served on port 443 and check Nginx logs for reload errors.
Keep the prior Nginx configuration and the service recovery procedure documented. Renewal failures are easier to correct when you can restore a known-good proxy configuration while investigating DNS, firewall, or ACME errors.
Troubleshoot the failures that appear most often
Infinite redirect loop
The usual cause is that Django never sees the trusted HTTPS signal. Check that the HTTPS Nginx block sends X-Forwarded-Proto https, that the HTTP block redirects rather than proxying, and that SECURE_PROXY_SSL_HEADER exactly matches the header Nginx sends. Also check for a second proxy that rewrites the header. Do not “fix” the loop by disabling every redirect before establishing which layer is misreporting the scheme.
Login or CSRF failure after enabling HTTPS
Check SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE, and the HTTPS entries in CSRF_TRUSTED_ORIGINS. Make sure the browser is using one consistent hostname rather than switching between apex and www. Proxy-header mistakes can affect Django’s CSRF protection, so verify the request scheme and origin seen by Django before weakening CSRF checks.
ACME challenge cannot be validated
- Confirm that the certificate name resolves to this VPS, not an old address.
- Test public reachability of TCP 80 through both firewalls.
- Check whether another Nginx server block captures
/.well-known/acme-challenge/. - Ensure a global redirect or application route is not returning an error for the challenge path.
- Use DNS-01 when HTTP-01 cannot reach the VPS, and grant the ACME client only the DNS permissions it needs.
Mixed-content warnings
Search templates, JavaScript, CSS, environment variables, and stored database content for absolute HTTP URLs. Change first-party resources to HTTPS or protocol-relative application URLs where appropriate, and update third-party endpoints only when they support HTTPS. A redirect on the main page cannot make an HTTP subresource secure.
Renewal succeeds but visitors see the old certificate
Check the deploy hook or timer action that should reload Nginx. Then inspect the certificate served on port 443, not just the files on disk. Multiple server blocks, an IPv6 listener, or a separate front-end proxy can cause visitors to reach a process that was never reloaded.
502 Bad Gateway or permission errors
A certificate change does not alter the application socket. If Nginx returns 502, verify that Gunicorn or Uvicorn is running, that the socket path matches proxy_pass, and that the Nginx worker user can access the socket and any static or media aliases. Read the Nginx error log and the application service log together; one usually identifies whether the failure is connection, permission, or application startup related.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Choosing an alternative to the Nginx path
Caddy and managed edge proxies can automate parts of certificate issuance and renewal, but the decision should be based on operational fit rather than a promise of “automatic HTTPS.” Compare each option on the points that affect this VPS:
- TLS termination: identify whether encryption ends at the VPS, at an edge service, or at both.
- Validation path: confirm how DNS, port 80, IPv6, and provider firewalls are handled.
- Renewal and reload: verify that renewed certificates are deployed to the process actually serving visitors.
- Proxy headers: document how the HTTPS scheme and client address reach Django.
- Cookie and HSTS controls: ensure you can configure Django and the front end without conflicting policies.
- Rollback: keep a recoverable configuration and a way to bypass a failed edge or proxy change.
The Nginx and Certbot workflow gives you direct control over these pieces. A different front end may reduce manual configuration, but it does not remove the need to validate hostnames, protect private keys, test renewals, and configure Django’s trust boundary.
Production checklist
- DNS A and AAAA records resolve to the intended VPS, or the unused record family has been removed.
- TCP 80 and 443 are allowed through every relevant firewall.
- Django is behind Gunicorn or Uvicorn, not exposed through its development server.
- The certificate private key is protected outside the application repository.
- Nginx has a 443 TLS block and a separate 80 redirect block.
proxy_set_header Hostpreserves the public hostname.X-Forwarded-Proto httpsis sent only by the HTTPS path.ALLOWED_HOSTScontains the real hostnames.SECURE_PROXY_SSL_HEADERis enabled only for a trustworthy proxy header.SECURE_SSL_REDIRECT, secure session cookies, and secure CSRF cookies are enabled at the appropriate stage.CSRF_TRUSTED_ORIGINScontains the exact HTTPS origins used by forms.- Nginx passes
nginx -tbefore every reload. - HTTP redirects, HTTPS certificates, logins, CSRF POSTs, static files, and media files have been tested.
- Certbot’s renewal job and post-renewal reload have been tested safely.
- A previous Nginx configuration and rollback procedure are available.
Frequently Asked Questions
Can Django terminate TLS itself on a VPS?
It can be made to accept HTTPS, but the production pattern is to terminate TLS at Nginx (or another dedicated reverse proxy) and forward requests to Gunicorn or Uvicorn. This keeps certificate handling and public HTTP behavior at the edge and avoids exposing Django’s development server.
Do I need port 80 if the site should be HTTPS-only?
Usually yes. Port 80 is used for the HTTP-01 ACME challenge and for redirecting visitors who type an HTTP URL. If your network cannot expose port 80, use a DNS-01 challenge and provide another controlled way to handle HTTP requests.
Why does setting SECURE_SSL_REDIRECT create a loop?
Django is probably not receiving a trustworthy indication that the original request was HTTPS. Correct the Nginx forwarded-proto header and Django’s SECURE_PROXY_SSL_HEADER configuration, then verify that only the HTTP listener redirects.
Is a successful certificate renewal enough to prove the site is updated?
No. The renewed files must be loaded by the Nginx process serving port 443. Confirm the deploy hook or timer reloads Nginx and inspect the certificate presented to an external client.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
