Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Nginx usually shows the wrong site because the request is reaching a different virtual server (server block) than the one you edited. Nginx first selects a listening address and port, then matches the request’s host name against server_name. If no name matches, it serves that port’s default server. HTTPS adds SNI and certificate selection during the TLS handshake, so port 443 can choose a different block from port 80.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Fix the problem by inspecting the configuration Nginx actually loaded, confirming DNS and the destination address, testing with an explicit Host header and SNI name, correcting both HTTP and HTTPS blocks, then validating and reloading Nginx.
As an Amazon Associate I earn from qualifying purchases.
How Nginx decides which site to serve
Every incoming request is evaluated in stages. Understanding the order prevents you from changing the wrong file or adding a wildcard that hides the real problem.
1. Nginx selects the listening socket
Nginx first looks at the local address and port that accepted the connection. A block listening on 192.0.2.10:80 is not eligible for a request that arrived on another address, and a block for port 80 cannot serve a connection received on port 443. IPv4 and IPv6 can also be separate sockets: 0.0.0.0:80 and [::]:80 may not have the same set of server blocks.
#1 Best Overall
Review the address on every relevant listen directive, not only the port number. A site can appear correct when tested through one address while another address still reaches a default block.
2. Nginx compares the Host value with server_name
After the socket is selected, Nginx compares the HTTP Host header with the server_name values available on that socket. Its matching priority is:
| Priority | Match type | Example | Meaning |
|---|---|---|---|
| 1 | Exact name | example.com |
Matches that host only. |
| 2 | Longest wildcard beginning with an asterisk | *.example.com |
Matches subdomains on the left; the most specific wildcard wins. |
| 3 | Longest wildcard ending with an asterisk | mail.* |
Matches names with the wildcard suffix; the most specific one wins. |
| 4 | Regular expression | ~^user[0-9]+.example.com$ |
The first matching regular-expression name in configuration order wins. |
The bare name and the www name are different values. A block containing only example.com does not match www.example.com.
3. An unmatched name goes to the default server
If the Host header does not match any eligible server_name, Nginx sends the request to the default server for that port. Without an explicit designation, the first server block listed for that address and port becomes the default. You can designate one deliberately with listen ... default_server.
default_server belongs to the listen socket, not to server_name. Writing server_name _; by itself does not make a block the catch-all. The underscore is merely a conventional name that is unlikely to be requested; the block becomes the fallback only when it is first for that socket or is marked default_server.
4. HTTPS performs SNI selection before HTTP matching
For HTTPS, the client sends a Server Name Indication (SNI) during the TLS handshake. Nginx can use that name to choose a server context and certificate before it receives the encrypted HTTP request and its Host header. Consequently, an incorrect or missing 443 block can present another site’s certificate or content even when the port 80 block is perfect.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
Symptoms and what they usually mean
| Symptom | Likely selection problem | First check |
|---|---|---|
| Nginx welcome page | Your host did not match a named block, so the default block answered. | Inspect every server_name on the receiving address and port, then identify the default. |
| A completely different customer’s site | The request is on a shared socket and matched another exact name, wildcard, or default block. | Dump the loaded configuration and look for duplicate or overly broad names. |
| HTTP is correct but HTTPS is wrong | Port 80 and port 443 use different server blocks, or SNI selects the wrong 443 block. | Check listen 443 ssl, certificate names, and the 443 server_name. |
The bare domain works but www does not |
Only one of the two host names is declared, or DNS for www points elsewhere. |
Check both DNS records and include both names in the intended block. |
| The site changed after a DNS update, but some users still see the old site | Resolvers or a proxy still use the previous address, or the new address has a different default block. | Resolve the name from several networks and test the origin directly. |
| Local tests are correct but public requests are wrong | A reverse proxy, load balancer, or CDN is terminating the request before it reaches this Nginx instance. | Compare the public response with a direct origin request carrying the intended Host and SNI. |
Repair the configuration step by step
1. Confirm where the domain resolves
Before changing Nginx, establish the destination address that clients are actually using. Query the authoritative records or a resolver you trust:
dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A
dig +short www.example.com AAAAReplace example.com with the real name. An A record returns IPv4; an AAAA record returns IPv6. If an AAAA record exists but Nginx is configured only on IPv4, IPv6 clients can reach a different machine or fail altogether. Verify that every returned address belongs to the intended server, proxy, or load balancer.
When a proxy or CDN is in front, its address is expected in public DNS. You still need to determine which origin it forwards to and whether it preserves the original Host header. Otherwise, an origin test can be mistaken for a public-routing test.
2. Inspect the configuration Nginx loaded
Do not rely on the file you last edited. Ask the running installation to print its complete, expanded configuration, including files pulled in with include:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo nginx -TOn systems where Nginx uses a non-default configuration path, use the installation’s equivalent configuration-inspection command or add the same -c option used by the service. Save the output while investigating and search it for:
- Every
server {block. - All
listen 80,listen 443 ssl, IPv4, and IPv6 bindings. - Every occurrence of the domain, including
wwwand wildcard names. - Repeated
server_namevalues in different files. default_serverflags and the order of blocks on each socket.- The certificate and key paths used by the relevant 443 block.
Duplicate names are especially misleading. Nginx may warn that a name has a conflicting server name and ignore one declaration. The warning identifies a real routing defect; resolve it rather than assuming the first file in a directory is active.
3. Test the origin with an explicit Host header
Testing the public URL alone can exercise a proxy, cached response, or the wrong DNS address. Send a request straight to the origin IP while retaining the domain in the Host header:
curl -i -H 'Host: example.com' http://203.0.113.10/Use the origin’s real address in place of 203.0.113.10. Test the alternate name as well:
Recommended Free Tools
curl -i -H 'Host: www.example.com' http://203.0.113.10/For HTTPS, use --resolve. It directs curl to the chosen address while sending both the URL host and the matching SNI name:
curl -vk --resolve example.com:443:203.0.113.10 https://example.com/
curl -vk --resolve www.example.com:443:203.0.113.10 https://www.example.com/The response body and headers now reveal what the origin does for each name, independent of public DNS. A different result between these commands and the public URL points to DNS, proxy, or cache routing rather than the local server block.
4. Correct the HTTP server block
Put every required name in the block that listens on the address receiving port 80 traffic. A minimal site block might look like this:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example;
index index.html;
}The exact root and index settings depend on the application. The routing-critical details are the matching names and the listening sockets. If the application should use HTTPS, this block can return a redirect instead of serving content:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Use a redirect only after the corresponding 443 block is valid. Otherwise, users are sent from a working HTTP endpoint to the wrong or broken HTTPS endpoint.
5. Configure a separate, matching HTTPS block
Port 443 needs its own block with the same host names, SSL enabled, and a certificate whose subject or Subject Alternative Name covers each requested name:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
root /var/www/example;
index index.html;
}The certificate paths above are examples; use the paths issued for your installation. A certificate for only example.com does not automatically cover www.example.com. Request a certificate containing every public name you serve, or create an intentional redirect and certificate arrangement for the names you do not serve directly.
Check that no unrelated 443 block is marked default_server for the same address. If a client omits SNI or sends an unrecognized name, that default block is the expected fallback; choose its behavior deliberately.
6. Create an intentional catch-all policy
Every socket should have a clear policy for unknown hosts. You can serve a neutral default page, redirect only when the destination is unambiguous, or reject the request. A rejecting HTTP catch-all can be written as:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}Code 444 is an Nginx-specific connection close used to discard an unwanted request; it is not a standard HTTP status. If clients need a normal response, use a documented 400, 404, or controlled redirect instead. The important safety property is that the catch-all is explicit and does not expose another customer’s site.
Define one deliberate default per address and port. Two blocks cannot both be the default for the same socket. Keep named application blocks narrow rather than adding a broad wildcard simply to make a request match.
7. Validate, reload, and retest
Syntax validation must happen before a reload:
sudo nginx -tProceed only when the test reports that the syntax is valid and the configuration test is successful. Then reload the service using the service manager on your system, for example:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo systemctl reload nginxA reload applies the new workers without dropping existing connections. If your installation is not managed by systemd, use its documented reload command. If the reload fails, keep the old workers running, read the error output, correct the reported file or permission, and run the syntax test again.
Retest all combinations after a successful reload:
- HTTP with the bare domain.
- HTTP with the
wwwname. - HTTPS with the bare domain and its certificate.
- HTTPS with the
wwwname and its certificate. - An unknown host, to confirm the intended catch-all behavior.
- Direct-origin requests and public requests when a proxy is involved.
Compare the response status, Location header, identifying headers, and body. For HTTPS, inspect the certificate subject and SAN, not just whether a TLS connection opened.
8. Use targeted debug logging when matching remains unclear
If the configuration appears correct but Nginx still chooses the wrong block, enable debug-level error logging for the affected server or test environment, following Nginx’s debugging guidance and ensuring the installed build supports debug logging. Reproduce one request, capture the selection details, and return logging to its normal level afterward. Debug logs can be verbose and may contain request data, so restrict access and avoid leaving them enabled on a busy public server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common configuration mistakes and safer alternatives
| Mistake | Why it fails | Safer correction |
|---|---|---|
| Editing a file that is not included | The running configuration never sees the change. | Use nginx -T and edit the file shown in the loaded output. |
| Declaring only the bare name | www.example.com does not match example.com, and vice versa. |
List both names or create an explicit redirect block for one of them. |
Putting default_server on a normal site |
Unknown hosts are served by that site’s content. | Move the flag to a deliberate catch-all and keep application blocks named. |
Assuming server_name _; is a catch-all |
The name does not override socket selection or default ordering. | Use listen ... default_server and define the desired fallback response. |
| Using a wildcard for convenience | A broad wildcard can capture hosts that should have matched a different site. | Prefer exact names; add only the narrowest wildcard that your routing design requires. |
| Fixing port 80 only | HTTPS has an independent 443 block and SNI decision. | Pair every HTTP change with an HTTPS name, certificate, and listen check. |
| Testing through a cached proxy | The response may not come from the Nginx instance you changed. | Use an origin IP with an explicit Host header, then test the public path separately. |
| Adding a second default for the same socket | Nginx cannot have two defaults on one address and port. | Choose one default and remove accidental flags from the others. |
How to verify certificate and SNI behavior
A wrong certificate is evidence that the TLS handshake selected an unintended server context. Check the certificate presented for the exact name:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsopenssl s_client -connect 203.0.113.10:443 -servername example.com -showcertsReview the certificate’s subject and SAN entries, then repeat with www.example.com. The -servername option is essential: without it, the test may intentionally exercise the default TLS context rather than the name-based one.
If the certificate is correct but the page is wrong, SNI selection succeeded and the problem is later HTTP routing, an application-level redirect, or content associated with that 443 block. If both certificate and page are wrong, inspect the 443 listen declarations, duplicate names, and default block first.
Quick Recap
A compact decision path
- Wrong on both protocols: verify DNS and origin address, then inspect exact names and the default block on the receiving sockets.
- Only the bare name is right: add or deliberately redirect the
wwwname, and verify its DNS record. - HTTP right, HTTPS wrong: inspect the 443 block, SNI certificate coverage, and any 443 default.
- Origin right, public URL wrong: investigate the proxy, load balancer, CDN, or stale DNS path.
- Everything looks right but selection is inexplicable: check duplicate-name warnings and capture a short debug log while reproducing one request.
Operational checklist
- DNS A and AAAA records point to the intended entry point.
- The loaded configuration, not merely an edited file, contains the expected blocks.
- Each required host name appears in the correct port-80 and port-443 blocks.
- Listen addresses include every address clients can use, including IPv6 where applicable.
- Only the intended block is
default_serveron each address and port. - HTTPS certificates cover every requested name and are paired with the matching 443 block.
nginx -tsucceeds before every reload.- Direct-origin and public tests produce the expected status, headers, certificate, and content.
- Unknown hosts follow an explicit serve, redirect, or reject policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
