Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A reverse proxy lets NGINX accept requests for your public domain and forward them to an application running privately on your Linux VPS, such as a service listening on 127.0.0.1:3000. The reliable setup order is: secure and update the VPS, start and test the backend locally, point DNS at the VPS, create and enable an NGINX server block, validate it with nginx -t, then add HTTPS and an HTTP-to-HTTPS redirect. This arrangement keeps the application port off the public internet while NGINX handles the public web ports, host forwarding, client-address headers and TLS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a reverse proxy does
When a browser requests https://example.com/, NGINX receives the public connection, sends a corresponding request to a configured upstream application, receives the response and returns it to the browser. The application can therefore listen on a private address while NGINX is the only internet-facing service.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The upstream may be a web app on 127.0.0.1:3000, another private address, or an HTTPS service on a different host. NGINX’s proxy_pass directive selects that upstream. Forwarded headers preserve the original host, client address and protocol so the application can generate correct absolute URLs, enforce secure cookies and write useful logs.
- Public edge: NGINX listens on TCP 80 and 443.
- Private service: your app listens on localhost or a protected private interface.
- Routing: a
server_namechooses the virtual host andlocationrules choose how requests are proxied. - Certificates: NGINX terminates HTTPS, unless you deliberately pass TLS through to another service.
Prepare the Linux VPS
Update the operating system and create an administrator
Use a currently supported Linux distribution and apply its security updates before exposing a service. Work from a non-root administrative account with sudo; keep root login and password authentication disabled where your distribution’s SSH policy allows it. The exact package commands vary by distribution. The examples below use Debian or Ubuntu conventions.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
sudo apt update
sudo apt full-upgrade
sudo adduser deploy
sudo usermod -aG sudo deployInstall NGINX from the distribution repository rather than copying an unknown binary. On Debian or Ubuntu:
sudo apt install nginxAllow only the traffic you need
Permit SSH from your administration network and web traffic on TCP ports 80 and 443 in both layers that apply to your VPS: the cloud provider’s security group and the operating system firewall. Do not open the application’s port 3000 (or an equivalent backend port) to the internet unless that application explicitly requires public access.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- SSH: restrict the source range if your provider supports it.
- HTTP: TCP 80, needed for ordinary HTTP and for the HTTP-01 certificate challenge.
- HTTPS: TCP 443, where browsers will connect after TLS is enabled.
If IPv6 is enabled, firewall and DNS rules must be correct for it as well as IPv4. An AAAA record pointing at an unconfigured address can make some visitors fail even when the A record works.
Run and test the backend privately
Bind to localhost or a private interface
Configure the application to listen on an address such as 127.0.0.1:3000. A private network address is also appropriate when NGINX and the application are on separate trusted hosts. Binding to localhost prevents unrelated internet clients from bypassing NGINX and its TLS, authentication and request limits.
Confirm the service before adding NGINX
Test the application from the VPS itself. A successful response proves that the process is running, the port is correct and the local listener is reachable.
curl http://127.0.0.1:3000/If this fails, inspect the application’s own service status and log first. NGINX cannot fix a stopped process, a wrong port, an application that binds only to another address, or a local firewall rule that blocks the connection.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Point DNS at the VPS
Create the records
Create an A record for the hostname you will publish, such as example.com or app.example.com, with the VPS’s current public IPv4 address. Add an AAAA record only if IPv6 is configured end to end on the VPS, firewall and provider network. If you publish both records, clients may try either address.
Verify resolution and the hostname
DNS changes can take time to appear according to the record’s TTL. Check what resolvers return before blaming NGINX:
dig +short example.com
getent hosts example.comThe hostname sent by the browser must match the NGINX server_name. A request for a name that is not listed may be handled by a different default server block, producing the wrong site or certificate.
Create the first NGINX server block
Use a minimal HTTP proxy
On Debian and Ubuntu, create /etc/nginx/sites-available/your-app with this configuration. Replace the example names and port with your actual hostname and local service.
Free tools Windows power users keep installed
One-click scans. No signup required.
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Host preserves the requested hostname. X-Real-IP carries the connecting client address, while X-Forwarded-For appends that address to an existing proxy chain. X-Forwarded-Proto tells the application whether the browser used HTTP or HTTPS at the edge. Configure your framework to trust these headers only from your NGINX proxy; otherwise a client could forge them by connecting directly.
Understand the proxy_pass URI rule
With proxy_pass http://127.0.0.1:3000;, NGINX passes the original request URI unchanged. If you include a URI, NGINX replaces the portion that matched the location. For example:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
location /api/ {
proxy_pass http://127.0.0.1:3000/internal/;
}A request for /api/users is sent with the matching /api/ prefix replaced by /internal/. Whether that is correct depends on the application’s route table. Test a representative URL after every path-prefix change; a trailing slash changes the result.
Enable the site
Enable the file with a symlink, then validate before reloading:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutesudo ln -s /etc/nginx/sites-available/your-app /etc/nginx/sites-enabled/your-app
sudo nginx -t
sudo systemctl reload nginxnginx -t checks syntax and attempts to open referenced files. Make it a mandatory step before every reload. If it reports an error, correct that file and run the test again; do not reload a configuration that has not passed.
Validate the complete request path
Test locally, then through the hostname
- Call the backend directly with
curl http://127.0.0.1:3000/. - Check the service manager and NGINX configuration with
systemctl status nginxandsudo nginx -t. - From a client that resolves the public DNS record, run
curl -I http://example.com/. - Confirm that the response headers and application logs show the expected host and forwarded client information.
If the public request reaches a different server, check DNS and the enabled server blocks before changing proxy directives. If NGINX does not reload, read the error reported by the command and then inspect the service journal and NGINX error log.
Add HTTPS with Let’s Encrypt
Install Certbot and request the certificate
For an internet-facing NGINX server, Ubuntu recommends a trusted Let’s Encrypt certificate. Install the NGINX integration and request names that resolve to this VPS:
sudo apt update
sudo apt install nginx certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo nginx -tCertbot’s NGINX plugin can locate the matching server block, add TLS directives and reload NGINX. The HTTP-01 challenge requires the certificate authority to reach TCP port 80 for the requested hostname, so DNS and the firewall must be correct and port 80 must remain available during issuance and renewal.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Review the generated TLS configuration
Read the resulting 443 server block instead of treating generated configuration as opaque. Confirm that every certificate name matches a name users will request, that the proxy headers remain in the HTTPS location, and that the private key is readable only by the accounts that need it. Do not copy obsolete SSL directives from an old tutorial; supported ciphers and protocol defaults depend on the installed NGINX and OpenSSL versions.
Check renewal
Most distribution packages install a Certbot timer or equivalent scheduled task. Check that timer and perform a supported dry run with the installed client. A successful initial certificate does not prove that future renewal will work if DNS, port 80 access or file permissions later change.
Redirect HTTP after TLS is working
Once the certificate has been issued and the 443 proxy works, use a dedicated port-80 server block to redirect browsers:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Keep the proxy settings in the 443 server block. The redirect preserves the path and query string while moving the browser to HTTPS. Do not remove port 80 entirely: it is still useful for HTTP-01 validation and for redirecting visitors who type an HTTP URL.
Proxy WebSockets and long-lived responses
A basic HTTP proxy is not sufficient for WebSockets. NGINX’s WebSocket support requires special configuration and has been available since version 1.3.13. Add the HTTP version and connection-upgrade mapping recommended for the NGINX release installed on your VPS, and apply it only to the location serving the WebSocket endpoint.
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# other http-level settings...
}
server {
# listen and server_name...
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Place the map in the http context, not inside a server or location. Use the application’s real WebSocket path and test an actual connection, not just an ordinary HTTP request. Streaming downloads, server-sent events and other long-lived responses may also need location-specific timeout or buffering changes. Adjust only the affected location and retest, because disabling buffering or greatly increasing timeouts globally can consume memory and worker connections.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Use an HTTPS upstream when the backend is remote
For a service on another host or across a trust boundary, NGINX can connect to an HTTPS upstream:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://backend.example.net;
}Configure trusted certificate material and verification for that upstream with directives such as proxy_ssl_trusted_certificate and the related proxy TLS settings. The upstream certificate must be valid for the name NGINX uses, or you must deliberately configure the appropriate name and trust chain. Disabling verification is not a sound default workaround; it removes the protection HTTPS is meant to provide.
Choose a routing design
| Design | How it works | Operational trade-off |
|---|---|---|
| One app, one hostname | One server block proxies every path to one upstream. | Simplest certificates, logs and application configuration. |
| Several apps, separate hostnames | Each hostname has its own server block and upstream port. | Usually easier to reason about than path rewriting; each app can have independent TLS and limits. |
| Several apps under path prefixes | Different location blocks proxy paths such as /api/ and /chat/. |
Path replacement, cookies, redirects and application base paths require careful testing. |
| HTTP upstream on localhost | NGINX encrypts the public hop; the local hop uses HTTP. | Usually adequate when both processes share a protected host. |
| HTTPS upstream | NGINX also verifies an encrypted connection to the backend. | Appropriate across hosts or trust boundaries, but requires certificate trust and name configuration. |
Hand-written files are directly inspectable, versionable and reproducible. A graphical proxy manager can reduce initial editing, but it adds another management layer and does not remove the need to understand DNS, firewall rules, certificates or upstream health.
Diagnose common failures
502 Bad Gateway
- Confirm the application process is running.
- Check that its listening address and port exactly match
proxy_pass. - Run the local
curltest from the VPS. - Check whether a host firewall policy blocks NGINX from reaching the private address.
- Read the NGINX error log and application log at the same time; connection-refused, timeout and name-resolution messages point to different fixes.
Wrong site or certificate
Verify the A and AAAA records, the browser’s requested hostname, the server_name values and which files are enabled in sites-enabled. A stale DNS record or an unintended default server commonly sends a valid request to the wrong virtual host.
HTTPS issuance or renewal failure
- Confirm the certificate includes every requested hostname.
- Check that the VPS clock is correct.
- Ensure TCP 80 is reachable for HTTP-01 validation.
- Verify that DNS still points to this VPS.
- Inspect the Certbot timer, its logs and the installed client’s dry-run result.
WebSocket disconnects
Check the endpoint path, proxy_http_version 1.1, the Upgrade and Connection headers, and any idle timeout between NGINX and the application. Test the WebSocket endpoint itself; a successful page load does not prove that the upgrade handshake works.
413 responses, timeouts or broken streaming
Change the relevant location rather than applying a broad global setting. Identify whether the problem is request-body size, an upstream read timeout, response buffering or an application limit, then change one setting, run nginx -t, reload and retest.
Quick Recap
Operate the proxy safely
- Run
sudo nginx -tbefore every reload, including reloads triggered by certificate renewal. - Keep NGINX, the operating system, OpenSSL and the application updated from supported repositories.
- Store configuration in version control without committing private keys.
- Monitor NGINX access and error logs together with the backend’s logs.
- Limit administrative access to SSH and protect the account used for deployment.
- Expose only ports 80 and 443 publicly unless a documented service requirement says otherwise.
- After changing DNS, firewall rules, certificates or upstream ports, test both the direct backend path and the public hostname.
Complete setup checklist
- Update a supported Linux VPS and create a non-root administrator.
- Install NGINX from the distribution repository.
- Allow SSH, TCP 80 and TCP 443 in the provider security group and host firewall.
- Start the application on localhost or a private interface and verify it with
curl. - Create the A record; add AAAA only when IPv6 is fully configured.
- Set
server_nameto the exact public hostname. - Add
proxy_passand the Host, client-address and protocol headers. - Enable the server block, run
sudo nginx -tand reload. - Test the public hostname over HTTP and inspect both sets of logs.
- Install Certbot, request the certificate, review the generated 443 block and test renewal.
- Redirect HTTP to HTTPS while leaving port 80 reachable for validation.
- Add WebSocket or streaming-specific settings only where the application needs them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
