Recommended Free Tools
If a subdomain displays your main website, DNS is usually doing its job: it has delivered the request to an IP address. The failure is normally in the web server’s hostname matching. NGINX or Apache cannot find a virtual host for the requested name, so it falls back to the default or first-listed site. Create a dedicated host configuration for the subdomain, configure its own files or proxy target, repeat the configuration for HTTPS, reload safely, and test with an explicit hostname and SNI request.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Why a subdomain can show the main domain
A DNS record maps a name such as sub.example.com to an IPv4 address, IPv6 address, or another hostname. DNS does not select a website directory, an application, or a virtual host. Several domains can resolve to the same server while the server returns completely different sites.
As an Amazon Associate I earn from qualifying purchases.
After the connection reaches the server, the web server examines the HTTP Host header. NGINX compares it with server_name; Apache compares it with ServerName and deliberate ServerAlias values. If no configured name matches, NGINX sends the request to the default server for that port, while Apache commonly uses the first virtual host listed for the matching address and port. The result is often the main domain’s document root or reverse-proxy application.
HTTPS adds another selection step. During the TLS handshake, the client sends the requested hostname as Server Name Indication (SNI). NGINX can choose a 443 server block from SNI before it processes the HTTP request. Apache likewise needs a matching TLS virtual host. A correct port-80 configuration therefore does not prove that port 443 is correct.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- DNS problem: the subdomain resolves to the wrong machine or an unintended IPv4/IPv6 address.
- Virtual-host problem: DNS is correct, but no exact host configuration exists or a broader/default host catches the request.
- Application problem: the correct site is served, but the application redirects the browser to the main domain.
- TLS problem: HTTPS selects the wrong certificate or 443 virtual host before the request reaches the intended application.
First determine which layer is failing
Do not change server files until you know whether the wrong content is caused by DNS, host matching, TLS, or an application redirect. Run the checks from a machine that can reach the server, and replace SERVER_IP with the address you intend to use.
1. Resolve every DNS record
Check both address families. A correct A record does not help if a stale AAAA record sends some visitors to another machine.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
dig +short sub.example.com A
dig +short sub.example.com AAAA
dig +short sub.example.com CNAMEOn systems without dig, use nslookup sub.example.com. The returned address must belong to the NGINX or Apache server that contains the subdomain configuration. If you use a DNS provider, CDN, load balancer, or managed reverse proxy, verify the origin configured behind it as well.
2. Separate a server response from a browser redirect
Request headers without following redirects:
curl -I http://sub.example.com/
curl -I https://sub.example.com/If the response contains Location: https://example.com/..., the server or application is actively redirecting. If there is no redirect and the response body is the main site, inspect virtual-host matching and document roots instead. A browser can hide this distinction by automatically following the redirect.
3. Test the intended IP while preserving the hostname
This bypasses public DNS but still sends the correct HTTP host and, for HTTPS, the correct SNI name:
curl -I --resolve sub.example.com:80:SERVER_IP http://sub.example.com/
curl -I --resolve sub.example.com:443:SERVER_IP https://sub.example.com/Compare the status code, every Location header, the Server and application headers, and the certificate subject or SAN shown by a verbose HTTPS request:
curl -v --resolve sub.example.com:443:SERVER_IP https://sub.example.com/If the --resolve request is correct but an ordinary request is wrong, DNS, a CDN, or a load balancer is routing users elsewhere. If both are wrong, work on the origin configuration.
Correct DNS before editing NGINX or Apache
Create or correct the record for the subdomain at the authoritative DNS provider:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
- Use an A record when the subdomain should resolve directly to an IPv4 address.
- Use an AAAA record only when the IPv6 address is configured on the intended server and serves the same virtual host.
- Use a CNAME when the provider deliberately gives you another hostname to follow. A CNAME cannot coexist with other record data at the same name in the usual DNS model.
Wait for the record’s TTL and resolver caches to expire. During that period, different networks may still reach the old address. Do not “fix” this by adding the subdomain to the main site’s aliases; that can hide the DNS mistake and make later routing ambiguous.
When multiple servers are behind a load balancer, every origin that can receive the request needs the same hostname configuration, or the load balancer must terminate TLS and route the hostname consistently. Check health checks and origin pools if only some requests show the main site.
Fixing NGINX hostname matching
Create an exact HTTP server block
Make a dedicated block for the subdomain. This static-file example uses a separate directory and index file:
server {
listen 80;
server_name sub.example.com;
root /var/www/sub.example.com;
index index.html;
access_log /var/log/nginx/sub.example.access.log;
error_log /var/log/nginx/sub.example.error.log;
}The important parts are listen 80, the exact server_name, and the intended root. Create the directory and place a distinctive test file there, such as an HTML page containing the subdomain name. A distinctive response makes it clear which server block answered while you troubleshoot.
Use a reverse proxy when the subdomain belongs to an application
For an application listening locally, keep the hostname in NGINX and forward only the matched site:
server {
listen 80;
server_name sub.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The upstream port is only an example; use the port and protocol your application actually listens on. The forwarded headers matter when the application builds absolute URLs, detects HTTPS, or records the original client address. If the application still redirects to the main domain, inspect its configured public URL after NGINX is confirmed to be matching correctly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep the main site’s names narrow
Inspect the main-domain block. It should list only names that are supposed to serve the main site:
server {
listen 80 default_server;
server_name example.com www.example.com;
root /var/www/example.com;
}Remove an accidental sub.example.com from this block. A wildcard such as *.example.com can intentionally catch many subdomains, but it will also catch names that do not have their own exact block. An exact name is more specific than a wildcard, so a dedicated exact block should win; nevertheless, remove broad patterns that express the wrong ownership and check for duplicate or regex names.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Configure HTTPS as a separate 443 block
A typical TLS block repeats the exact hostname and points to a certificate whose subject or SAN covers the subdomain:
server {
listen 443 ssl;
server_name sub.example.com;
ssl_certificate /etc/ssl/sub.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/sub.example.com/privkey.pem;
root /var/www/sub.example.com;
index index.html;
}Use the same proxy configuration instead of root when the site is an application. The certificate path and TLS directives vary by deployment, so retain the settings supplied by your certificate or hosting system. The essential requirements are a certificate covering sub.example.com, a 443 listener, and an exact matching server_name.
If HTTP should redirect to HTTPS, make that behavior explicit in the subdomain’s own port-80 block:
server {
listen 80;
server_name sub.example.com;
return 301 https://sub.example.com$request_uri;
}Do not redirect the subdomain to example.com unless that is a deliberate product decision. A canonical-host redirect in a shared include file is a common cause of an apparently correct virtual host still ending up at the main domain.
Validate and reload safely
Run a syntax test before reloading:
sudo nginx -tProceed only when NGINX reports that the configuration test is successful:
sudo systemctl reload nginxA reload lets existing connections finish while workers adopt the new configuration. If the test fails, read the file and line number in the error output, correct the issue, and test again. Do not reload a configuration that has failed validation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFind which NGINX file is actually loaded
Many distributions include files through a main configuration and a sites-enabled directory. A perfectly written file has no effect if it is not included. Inspect the complete parsed configuration and search for every occurrence of the hostname:
sudo nginx -T 2>/dev/null | grep -n "sub.example.com"Check that the expected block appears once for port 80 and once for port 443, that an unintended default_server is not selected, and that an include file has not added a duplicate name. Duplicate names can produce warnings and make the first matching definition win in ways that are difficult to predict from separate files.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Fixing Apache virtual-host matching
Create a dedicated port-80 virtual host
Use an explicit ServerName and a document root or proxy configuration that belongs only to the subdomain:
<VirtualHost *:80>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
ErrorLog ${APACHE_LOG_DIR}/sub-error.log
CustomLog ${APACHE_LOG_DIR}/sub-access.log combined
<Directory /var/www/sub.example.com>
Require all granted
AllowOverride None
</Directory>
</VirtualHost>Use the access and error log paths appropriate for your distribution. The <Directory> permissions must allow Apache to read the files; a correct hostname with an unreadable directory produces a permission error rather than the main site.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use aliases only for names that should share the site
Add ServerAlias deliberately, for example when both www.sub.example.com and sub.example.com are intended to be the same site:
<VirtualHost *:80>
ServerName sub.example.com
ServerAlias www.sub.example.com
DocumentRoot /var/www/sub.example.com
</VirtualHost>Do not put the subdomain in the main site’s ServerAlias list. Apache uses the first matching name when several virtual hosts could answer the same address and port, so an accidental alias can make the main site appear to “win.” Explicit ServerName values also prevent the server’s guessed hostname from becoming the effective match.
Add a parallel 443 virtual host
HTTPS needs its own virtual host and certificate settings. A minimal static-file pattern is:
<VirtualHost *:443>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/sub.example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/sub.example.com/privkey.pem
<Directory /var/www/sub.example.com>
Require all granted
AllowOverride None
</Directory>
</VirtualHost>Use the certificate chain and key paths required by your TLS setup. If the subdomain is proxied to an application, configure the proxy module and target inside this 443 virtual host rather than inheriting the main site’s proxy rules.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEnable the site and modules where required
On distributions that use separate available and enabled directories, place the file in the available directory and enable it with the platform’s site-enabling command. Ensure the SSL and proxy modules required by your configuration are enabled. The exact command differs between distributions, so follow the conventions already used by the server rather than copying a command intended for another operating system.
Inspect Apache’s parsed order
Ask Apache which virtual hosts it has loaded:
sudo apachectl -SOn Windows, the equivalent diagnostic is:
httpd.exe -SThe output shows addresses, ports, the default virtual host, file locations, ordering, and duplicate names. Confirm that sub.example.com appears under both *:80 and *:443 when HTTPS is enabled. If the name is absent, the file is not included or the directive is malformed. If it appears more than once, remove the unintended definition or alias.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Check syntax and reload
Use Apache’s configuration test before applying changes:
sudo apachectl configtestAfter it reports Syntax OK, reload Apache through the service manager used by your system:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →sudo systemctl reload apache2Some systems use the service name httpd instead. A failed syntax test should be fixed before any reload or restart; otherwise the active configuration remains unchanged or the service may fail to start.
HTTPS, SNI, certificates, and redirect traps
When a browser opens https://sub.example.com, the server may choose a TLS context before it sees the HTTP Host header. That is why a correct HTTP block cannot compensate for a missing or incorrect 443 block. Test HTTPS independently with curl --resolve and inspect the certificate presented during the handshake.
- The certificate must cover the exact subdomain in its subject or Subject Alternative Name. A certificate for only
example.comdoes not automatically coversub.example.com. - The 443 NGINX
server_nameor ApacheServerNamemust match the requested subdomain. - The 443 block must use the subdomain’s document root or upstream, not the main domain’s inherited proxy target.
- If a CDN or load balancer terminates TLS, configure the hostname and certificate there as well as on the origin when the connection continues securely to the origin.
There are two different redirect cases. A redirect from the server’s intended subdomain block to HTTPS is normal when you deliberately enforce HTTPS. A redirect from the subdomain to the main domain indicates a canonical URL, framework setting, reverse-proxy rule, or rewrite that names the wrong host.
Inspect response headers at every hop:
curl -sS -D - -o /dev/null --resolve sub.example.com:443:SERVER_IP https://sub.example.com/Look for Location, Strict-Transport-Security, proxy headers, and cache indicators. Check NGINX or Apache access logs together with the application logs at the same timestamp. If the origin log records the subdomain but the application emits a main-domain Location, correct the application’s public URL or trusted proxy settings. If no origin request appears, investigate DNS, CDN routing, or a load balancer first.
NGINX and Apache: what differs
| Concern | NGINX | Apache |
|---|---|---|
| Hostname directive | server_name inside a server block |
ServerName and deliberate ServerAlias inside VirtualHost |
| Static content | root and optional index |
DocumentRoot plus directory access rules |
| Application proxy | location with proxy_pass and forwarded headers |
Proxy directives inside the matching virtual host, with required modules enabled |
| Unmatched name | Default server for the port; an explicit default_server controls the fallback |
Usually the first listed virtual host for the matching address and port |
| HTTPS | Separate 443 server block with TLS settings and matching server_name |
Separate 443 VirtualHost with TLS settings and matching ServerName |
| Configuration inspection | nginx -t validates; nginx -T prints the merged configuration |
apachectl configtest validates; apachectl -S prints parsed vhost order |
The conceptual fix is the same: make the hostname-to-site mapping explicit for each port, remove accidental aliases, and verify the running configuration rather than trusting an unreferenced file.
Common symptoms and targeted fixes
| Symptom | Likely cause | What to check |
|---|---|---|
| HTTP shows the main site with no redirect | No exact port-80 host match, an accidental alias, or default-vhost fallback | Exact hostname, main-site aliases, default block, and parsed configuration |
| HTTP works but HTTPS shows the main site | Missing or mismatched 443 block, SNI selection, or wrong certificate configuration | Certificate SAN, 443 hostname directive, and curl --resolve over HTTPS |
| HTTPS shows a certificate warning | The selected TLS vhost presents a certificate that does not cover the subdomain | SNI match, certificate SAN, and whether a CDN terminates TLS |
| Address changes to the main domain | Application canonical URL, rewrite rule, proxy headers, or cached redirect | Location header, application settings, rewrite files, and logs |
| Only some visitors see the wrong site | Stale DNS, an incorrect AAAA record, multiple origins, or uneven load-balancer configuration | A and AAAA answers, resolver differences, origin pool, and every server’s vhost files |
| New configuration has no effect | File is not included or site is not enabled | nginx -T or apachectl -S, then reload status |
| Requests return 403 or 404 after matching | Permissions, wrong root, missing index, or upstream path issue | Site-specific error log, filesystem permissions, root path, and proxy target |
A complete verification sequence
Use this order after making changes so each result narrows the remaining possibilities:
- Resolve
sub.example.comA, AAAA, and CNAME records and confirm every returned destination is intentional. - Place a distinctive test response in the subdomain’s document root or configure a distinctive application endpoint.
- Run the server’s syntax check:
nginx -tfor NGINX orapachectl configtestfor Apache. - Inspect the loaded configuration:
nginx -Tfor NGINX orapachectl -Sfor Apache. - Reload the service only after validation succeeds.
- Test HTTP with
curl -I --resolve sub.example.com:80:SERVER_IP http://sub.example.com/. - Test HTTPS with
curl -v --resolve sub.example.com:443:SERVER_IP https://sub.example.com/; verify the certificate and response headers. - Repeat the tests without
--resolveto verify public DNS and any intermediary service. - If a redirect remains, identify the exact response that emits the
Locationheader by comparing origin and application logs. - Remove the temporary distinctive test page, confirm permissions and caching behavior, and test from an independent network.
Preventing the problem on future subdomains
- Document one owner, root directory or upstream, certificate, and log location for each hostname.
- Use exact names for production sites. Reserve wildcards for a deliberate multi-tenant design with a clear fallback.
- Keep the main domain’s aliases limited to names that truly serve the main application.
- Define both port-80 and port-443 behavior whenever HTTPS is offered, even if port 80 only redirects.
- Configure IPv4 and IPv6 together, or omit IPv6 until the same virtual host is ready on the IPv6 listener.
- Run a syntax check and parsed-configuration inspection as part of every deployment.
- Monitor access and error logs by hostname so a fallback response is visible instead of being mistaken for a successful deployment.
- When using a reverse proxy or CDN, keep the public hostname, forwarded-protocol settings, and canonical URL consistent across every layer.
When the correct fix is not a virtual-host change
If the explicit --resolve test reaches the correct site but public requests do not, changing NGINX or Apache will not repair the path users are taking. Correct the DNS record, stale AAAA entry, CDN hostname mapping, load-balancer listener, or origin pool. If both explicit and public requests reach the right virtual host but the browser ends at the main domain, the remaining fault is in application routing, rewrite rules, canonical URL settings, trusted proxy headers, or a cached redirect.
Once the hostname matches on the intended port, the certificate is valid for that hostname, and the application’s canonical URL agrees with it, the subdomain will stop falling through to the main site without requiring a separate IP address.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
