To stop visitors from opening your website by its IP address, make the origin reject every hostname except the domains you actually serve. In NGINX or Apache, that means an explicit default (catch-all) virtual host on every exposed HTTP and HTTPS listener, with the production site in a separate, hostname-specific block. If a CDN such as Cloudflare fronts the site, add an origin control—an IP-range allowlist, Authenticated Origin Pulls, or Cloudflare Tunnel—when you must prevent requests from bypassing the edge.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What “direct IP access” means
A browser normally requests https://example.com/. DNS resolves that name to an address, and the request includes a hostname so the web server can select the right virtual host. A user can instead enter http://203.0.113.10/ or https://203.0.113.10/. That connection still reaches your listener, but the hostname no longer identifies your intended site.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Direct-IP access is usually a virtual-host routing problem, not a failure of DNS. If the server’s default site happens to be your production site, an IP request receives the same pages. Even after you add a catch-all, the address remains reachable unless a network control prevents connections. A deliberate design therefore has two layers:
- Application-layer routing: reject unknown Host values, including the IP address, on HTTP and HTTPS.
- Origin access control: when a CDN is used, restrict who can connect to the origin so a caller cannot bypass the CDN’s WAF, rate limits, or logging.
How a web server chooses a site
NGINX request selection
NGINX first chooses a listening socket by local IP address and port. It then compares the HTTP Host header with each server_name on that listener. If nothing matches—or the request has no Host header—NGINX routes the request to the default server for that port. The first declared server is the default unless one is explicitly marked default_server.
When a client uses an IP URL, the Host header normally contains that IP address. If you have accidentally listed the address as a server_name, or if your production block is the default, the request can serve production content. A catch-all must therefore be explicit, and the production block must contain only the names you intend to publish.
Why a catch-all is different from deleting a DNS record
Removing an A or AAAA record stops ordinary name resolution; it does not stop traffic sent directly to an already known address. Likewise, changing the canonical URL or adding a redirect does not prevent the origin from answering. The listener must receive an unknown name and deliberately reject it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Block HTTP requests in NGINX
1. Add a default server for IPv4 and IPv6
Place a minimal catch-all before, or independently of, your production configuration:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name "";
return 444;
}444 is an NGINX-specific behavior that closes the connection without a response body. It is the status shown in NGINX’s documented no-Host example. You may choose 400 (bad request) or 421 (misdirected request) instead if your monitoring, clients, or upstream load balancers require a standard HTTP response. Pick one intentionally: a silent close reduces response information, while a normal status is easier to observe and troubleshoot.
2. Keep the real site in its own server block
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /srv/www/example;
index index.html;
# application, logging, and redirect directives
}Do not put the production names on the catch-all. Also remove any old block that lists the origin IP as a server_name. If another included file defines a default server on port 80, NGINX can select that block instead of the one you intended; inspect the complete, rendered configuration before reloading.
3. Validate and reload safely
- Run
nginx -tand confirm that syntax and referenced files pass. - Review the output of
nginx -Tto find everylisten 80and identify which block is markeddefault_server. - Reload with your service manager, for example
systemctl reload nginx, so existing connections are not needlessly dropped.
Keep a rollback copy of the previous configuration. A syntax check cannot prove that the right block wins; only requests to the IP, unknown names, and real domains can do that.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHTTPS requires a separate catch-all
TLS happens before HTTP host routing
For HTTPS, certificate negotiation occurs before NGINX receives the HTTP request. When several TLS virtual hosts share an address, the client can receive the default server’s certificate before NGINX knows which HTTP Host value will follow. Blocking only port 80 therefore leaves port 443 exposed and can still disclose or serve the production site.
Rank #2
Build a non-production default TLS path
Create a default server on 443 for both address families and ensure that it cannot return your application content. The exact rejection method depends on your NGINX version and TLS setup. A common deployment uses a dedicated certificate for the default server, serves no document root, and rejects the HTTP request; another uses a TLS-level rejection feature available in that version. Verify the directive and certificate requirements in the NGINX documentation installed with your release before deploying.
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/tls/reject.example/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/reject.example/privkey.pem;
return 421;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/tls/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/example.com/privkey.pem;
root /srv/www/example;
}The sample illustrates the routing shape, not a universal certificate policy. The default certificate must be valid for the clients you expect to test, or clients will stop at a certificate warning before receiving the HTTP rejection. Most importantly, the default TLS path must not contain the production root, proxy settings, or application fallback.
SNI and the unavoidable certificate detail
A client that connects to an IP may send that IP as the TLS Server Name Indication (SNI), omit SNI, or send a hostname deliberately. A certificate mismatch can be a useful signal, but it is not an access-control mechanism: clients can ignore warnings, and a correctly trusted certificate could cover the requested name. Enforce the rejection at the default TLS virtual host and then add origin network controls when bypass prevention is required.
Applying the same policy in Apache and other servers
Apache, Caddy, HAProxy, IIS, and ingress controllers all have a concept equivalent to a default or catch-all virtual host. Define that default explicitly on every HTTP and HTTPS listener, and make the production virtual host match only its approved hostnames. Return a deliberate error or close the connection in the catch-all. Directive names, certificate selection, and whether a TLS handshake can be rejected early are server-specific; use the current official documentation for the product and version you run rather than copying NGINX syntax.
For Apache, check the order and enabled-site links that determine the first virtual host, then inspect the effective configuration (for example, with the platform’s virtual-host listing command) before reloading. A configuration that looks correct in one file can be overridden by a distribution’s default site or an included file.
When a CDN or Cloudflare is in front of the origin
What proxying changes—and what it does not
When a DNS record is proxied through Cloudflare, normal DNS answers expose Cloudflare addresses rather than the origin address. Cloudflare also denies direct requests to a Cloudflare IP with Error 1003 and tells visitors to use the domain name. Those behaviors protect the edge endpoint, not automatically the origin: anyone who discovers the origin address can still connect unless the origin enforces a rule.
Do not block Cloudflare ranges indiscriminately. Proxied visitor traffic arrives from Cloudflare’s shared address space, so an origin firewall that denies those ranges can break every normal request. Instead, allow the published Cloudflare ranges on the required ports and deny other sources, maintaining the list as Cloudflare changes it.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Authenticated Origin Pulls
Authenticated Origin Pulls (AOP) adds client-certificate authentication between Cloudflare and your origin. With AOP enforced, an HTTPS request that does not present the required client certificate receives no origin response. This is stronger than relying on secrecy of the IP address, but it requires TLS configuration and certificate lifecycle management.
A global AOP setup uses a Cloudflare-provided certificate. Configure the origin to trust that certificate and require client authentication—for example, Apache uses SSLVerifyClient require, while NGINX uses ssl_verify_client on. Test the direct origin before and after enforcement. A direct request without the client certificate should fail, while the same hostname through Cloudflare should continue to work.
Zone-level AOP uses a certificate you upload and is intended for stricter, account-specific control. Cloudflare requires Full or Full (strict) encryption for that setup. Plan renewal, distribution, and emergency rollback before enabling enforcement.
Cloudflare Tunnel
Cloudflare Tunnel uses an outbound-only connector from your environment to Cloudflare. The origin does not need a publicly routable IP, so there is no inbound address for an attacker to open directly. This is the strongest architectural option in the cited Cloudflare guidance when your application and traffic types are supported. It introduces a connector process, health monitoring, and a dependency on the supported Tunnel traffic model; test failover and maintenance procedures before removing public ingress.
Compare the protection choices
| Option | What it blocks | Residual exposure | Operational considerations |
|---|---|---|---|
| NGINX or Apache catch-all | Unknown Host values and direct-IP virtual-host routing | The listener and address remain reachable. A forged Host can still select a configured site if other controls are absent. | Simple local configuration; must cover HTTP and HTTPS and every address family. |
| CDN proxy plus origin firewall allowlist | Direct connections that do not originate from approved CDN ranges | Depends on complete, maintained allowlists; the ranges are shared by many customers. | Keep ranges current and avoid denying them accidentally. |
| Authenticated Origin Pulls | HTTPS requests lacking the required client certificate | Requires TLS and certificate lifecycle management; it does not apply to non-TLS traffic. | Global certificates are shared by the provider; customer-uploaded zone certificates provide stricter account-specific control. |
| Cloudflare Tunnel | Public inbound origin access | Requires the connector and a supported traffic model. | Outbound-only design; no publicly routable origin IP is needed. |
Choose an architecture based on your threat model
You only need the IP URL to stop serving the site
Use HTTP and HTTPS catch-all virtual hosts. This prevents accidental exposure through default-site routing while leaving the server reachable for administration, monitoring, and other services. It does not hide the address or stop a caller who knows a valid hostname and can connect directly.
You need users to pass through the CDN/WAF
Proxy the DNS record, restrict origin firewall ingress to the CDN’s current ranges, and retain the catch-all as a defense against configuration mistakes. This combination prevents ordinary direct connections while preserving CDN visitor traffic. Include API endpoints and health checks in the allowlist design; a probe running outside the CDN will fail unless it has a separate permitted path.
You need cryptographic proof that the edge is calling the origin
Use AOP on HTTPS, choosing global or zone-level certificates according to your control requirements. Keep a tested break-glass procedure: certificate expiry, a wrong trust chain, or an accidental enforcement change can make the public site unavailable even though the application itself is healthy.
You cannot expose an inbound origin address
Use Tunnel when its connector and protocol support match the application. Remove public inbound rules only after the tunnel is healthy, monitored, and able to handle your production and administrative workflows.
Verification checklist
Run these checks from a network that is not implicitly trusted by your firewall. Perform them after a controlled change and record the response, TLS error, and server logs.
- Request
http://ORIGIN_IP/over IPv4. It should be rejected, close, or return only the intentional catch-all response. - Request
https://ORIGIN_IP/over IPv4. It should fail the intended TLS or client-authentication check, or reach the non-production default and be rejected. - If the server publishes IPv6, repeat both tests with the IPv6 literal in brackets, such as
https://[2001:db8::10]/. - Send an unknown hostname to each listener, for example
curl -i -H 'Host: not-configured.example' http://ORIGIN_IP/. It must not return production content. - Request the real domain over HTTP and HTTPS and verify the expected redirect, certificate, status, and application response.
- If AOP is enabled, make a direct-origin curl request without the client certificate; it should fail. Then request the domain through Cloudflare and confirm success.
- Inspect access and error logs to ensure rejected traffic is distinguishable from legitimate application requests.
Cloudflare specifically recommends direct-origin curl verification after AOP enforcement. Do not treat a successful browser test through the domain as proof that the origin is protected; that test may never have contacted the origin directly.
Troubleshooting common failures
The IP still serves the site over HTTP
- Confirm the catch-all is marked
default_serveron both IPv4 and IPv6. - Search the complete configuration for the origin IP, a wildcard
server_name _in the wrong block, and another default listener. - Check that the request reaches the server you edited; stale DNS, NAT, or a load balancer may point elsewhere.
HTTP is blocked but HTTPS shows a certificate or the homepage
- Add and test a separate 443 default server; port 80 rules do not govern TLS.
- Ensure the default TLS block has no production root, proxy pass, or fallback include.
- Check SNI behavior with both an IP request and an unknown hostname. A certificate warning alone is not proof that content cannot be fetched.
Cloudflare traffic fails after an origin firewall change
- Verify that the current Cloudflare ranges are allowed on 443 (and 80 if you intentionally support HTTP).
- Check whether health checks, API integrations, or administrative probes originate outside those ranges.
- Review firewall logs for an over-broad deny rule before changing application settings.
AOP blocks the public site
- Confirm the origin trusts the correct AOP certificate chain and that client verification is enabled only on the intended virtual host.
- Check that the zone uses Full or Full (strict) encryption when required for zone-level AOP.
- Temporarily roll back enforcement using your documented emergency procedure, correct the trust or certificate problem, and retest direct and proxied requests separately.
Operational details people often miss
- IPv6: An AAAA record can expose a different listener or firewall policy. Configure and test IPv6 explicitly.
- Other ports: Catch-alls on 80 and 443 do not protect SSH, databases, game servers, mail, or custom API ports. Apply network access controls appropriate to each service.
- Health checks: A load balancer or uptime monitor may use an IP and no Host header. Give it a dedicated hostname and allowlist, or configure the check to send the production Host value.
- Logs and status codes: 444 is useful for dropping unwanted connections but can be confusing in external monitoring. Use 400 or 421 when an explicit response is operationally preferable.
- Configuration drift: Package updates can re-enable a distribution’s default site. Include a rendered-configuration check in deployment review.
- Rollback: Keep the previous certificate, virtual-host files, firewall rules, and tunnel settings available so a failed change can be reversed without guessing.
Frequently asked questions
Can I block direct IP access with DNS alone?
No. DNS controls name resolution, while a direct-IP request bypasses it. The origin must reject unknown hostnames or refuse the connection at a firewall, TLS-authentication layer, or private network boundary.
Will a catch-all stop someone who sends my real domain in the Host header?
No. A valid Host value intentionally selects the production virtual host. If bypassing the CDN matters, combine hostname routing with an origin firewall allowlist, Authenticated Origin Pulls, or an outbound-only Tunnel.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do I need to block both the IP URL and an unknown hostname?
Yes. Test both forms on every listener. They exercise the same default-routing policy in different ways and can reveal a mismatched virtual-host or IPv6 configuration.
What should an API or non-browser client receive?
Choose a documented response such as 400 or 421 if clients need a machine-readable result. A 444 close is valid for NGINX but may appear as a network error to libraries and monitoring systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
