How to Fix an Nginx Reverse Proxy Redirecting to the Wrong Domain

Find the first response that introduces the wrong hostname, then fix that layer. A wrong domain can come from Nginx selecting the wrong virtual server, an application generating an absolute redirect from its private hostname, or Nginx constructing a redirect from its own server settings. The remedy is different in each case.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

Use the procedure below to trace the complete redirect chain, correct host and scheme forwarding, rewrite backend headers only when necessary, and configure intentional www/non-www canonicalization without creating a loop.

#	Preview	Product	Price
1		Recipe Book to Write in Your Own Recipes, Spiral Blank Cookbook 150 Recipes	$14.98	Buy on Amazon
2		Pipilo Press Blank Family Cookbook Recipe Binder - 6.5 x 8.2 in Hardcover Spiral Bound - 90 Ruled...	$7.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Start by identifying who generated the wrong redirect

Do not change several directives at once. First capture every hop between the public URL and the final response. The first Location header containing the wrong domain is the most useful clue: it tells you which layer made the decision.

Capture the complete chain with curl

Run the test from a machine that can reach the public endpoint:

#1 Best Overall

Recipe Book to Write in Your Own Recipes, Spiral Blank Cookbook 150 Recipes

• B5 Recipe Book: This hardcover blank recipe book measures 10''×7.3'', containing 150 blank pages, comes with 1 sheet of DIY category stickers, perfect for writing down your own recipes and organizing them in one place.
• Practical Layout - 5 pages of conversion charts show you everything you'll ever need to know in the kitchen. The table of contents will help organize your personal favorite recipes. A back pocket is designed for loose items.
• Easy to Use - This blank cookbook is made of high-quality paper with a beautiful hardcover for long-term use. The sturdy gold double-wire spiral binding makes writing easier and page turning smoother.
• Make Your Own Recipes - This blank cookbook has up to 150 blank pages for you to write in your own recipes, with plenty of space to record ingredients and instructions. You can write down all the special tips for your family members.
• Thoughtful Gift - A personalized recipe book makes a thoughtful gift for your children or newlyweds, and a great gift for housewarming, weddings, bridal showers, anniversaries, or any other occasion.

$14.98

Buy on Amazon

curl -I -L https://public.example/path

-I requests headers only and -L follows redirects, so the output shows each status code and each Location value. Repeat without -L when you need to inspect only the first response:

curl -I https://public.example/path

Record the status and location at every hop. For example, if the public request first returns Location: http://backend:8080/login, the upstream application exposed its private address. If the first response points to a different public hostname, inspect Nginx virtual-server selection and any deliberate canonicalization rule. If the upstream is correct but a later Nginx-generated redirect changes the host, review Nginx’s redirect settings.

Use the redirect origin to choose the fix

Verify that Nginx selected the intended virtual server

Nginx matches the request’s Host value against server_name within the appropriate listen address and port. If no name matches, the default server for that address and port handles the request. An earlier or default block can therefore issue a redirect before the proxy block you were editing ever runs.

Inspect the loaded, not merely edited, configuration

1. Run nginx -T with the privileges used to administer Nginx. This prints the complete configuration after included files have been expanded.
2. Find every server block listening on the affected port, including both the HTTP and HTTPS listeners.
3. Confirm that the public name appears in the intended block’s server_name. Check spelling, aliases, and whether an old name is still listed in the same block.
4. Check which block is marked default_server for that address and port. An unmatched request will use it.
5. Verify that the TLS listener has the expected certificate and name configuration. A request arriving on 443 can be handled by a different block from the one handling port 80.

Do not assume the file you recently changed is active. Distribution packages commonly include separate files and symlinks, and an include can leave an older block loaded. The output of nginx -T is the authoritative view of what the running configuration will use after reload.

Test host matching without changing DNS

If DNS is still being migrated, send a chosen host header to the server’s address:

curl -I --resolve public.example:443:203.0.113.10 https://public.example/path

Replace the example address with the server’s real address. This preserves the URL host for TLS and HTTP while directing the connection to the selected address. Compare it with a request using the old hostname and with a request that omits the expected name. If only the unmatched request takes the wrong redirect, the default-server arrangement is the issue rather than the proxy application.

Pass the public host and request context to the upstream

For a proxied request, Nginx does not automatically send the browser’s original host as the upstream Host. The reverse-proxy behavior uses the $proxy_host value by default. An application that builds absolute links or login callbacks from that header can consequently redirect a visitor to an internal name or port.

Set the headers in the proxy location

Place the following directives in the location that contains proxy_pass:

location / {
    proxy_pass http://app_backend;

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
}

• Host $host gives the application the public hostname that Nginx selected.
• X-Forwarded-For preserves the client address chain for applications that use it for logging, redirects, or security decisions.
• X-Forwarded-Proto $scheme tells the application whether the browser connected with HTTP or HTTPS, which prevents an HTTPS request from being downgraded to an HTTP login URL.
• X-Forwarded-Host $host supplies the original host through a separate conventional header when the framework reads that header instead of Host.

If the public service uses a nonstandard port, determine how the application expects that information. Some frameworks use an X-Forwarded-Port header or the port portion of the original host. Configure the value deliberately rather than assuming that $host includes a port; test an actual redirect from that port.

Configure the application’s trusted-proxy policy

Forwarded headers have no effect if the application ignores them, and accepting them from untrusted clients can be unsafe. In the application, enable its documented trusted-proxy or proxy-awareness setting for the Nginx address, then specify which forwarded scheme and host headers it may use. The exact setting depends on the framework. Verify it by logging the request’s perceived scheme, host, and port, then trigger a redirect such as a login or trailing-slash change.

Do not solve an application trust problem by blindly copying arbitrary client-supplied X-Forwarded-Host values. Nginx should overwrite the headers at the trusted boundary, and the application should trust only the proxy path you control.

Rewrite absolute backend redirects with proxy_redirect

Correct forwarding headers first. If the application still returns an absolute private URL, rewrite that response at the proxy. The proxy_redirect directive changes Location and Refresh response headers from the proxied server.

Replace a backend origin with the public request path

location / {
    proxy_pass http://app_backend;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_redirect http://backend:8080/ /;
}

With this form, a response such as Location: http://backend:8080/login becomes a redirect on the current public origin, preserving the request’s host and path base.

Replace it with a fixed public origin

location / {
    proxy_pass http://app_backend;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_redirect http://backend:8080/ https://public.example/;
}

Use a fixed public origin only when every request through this location is intentionally served from that host. If several public names share the proxy and the requested host should be preserved, a relative replacement or a variable-based public value is safer than hard-coding one name.

Watch for path prefixes and ports

The text on the left side must match the origin and path that the upstream actually emits. Capture the exact header with curl -I; do not guess whether the application includes a trailing slash, a path prefix, or a nondefault port. A rule for http://backend:8080/ will not match a header that says http://backend:8080/app/ unless the replacement pattern accounts for that path.

Keep rewriting narrow. A broad substitution can hide a broken application configuration, alter redirects for unrelated upstreams, or turn an intentionally different origin into the public one. After adding the rule, test login, logout, password-reset, API, and trailing-slash paths separately.

Rank #2

Pipilo Press Blank Family Cookbook Recipe Binder - 6.5 x 8.2 in Hardcover Spiral Bound - 90 Ruled Pages with Memo Pocket - Write In Your Own Recipes & Meal Planning Notebook

• Create a Culinary Legacy: The Pipilo Press Blank Family Cookbook Recipe Binder offers a timeless platform for chronicling beloved recipes. With its hardcover and spiral binding, this recipe book to write in your own recipes ensures durability and ease of use for generations
• Thoughtful Gifting Choice: This book for writing recipes is an ideal present for various occasions, adding a personal touch to celebrations. Its elegant design makes it perfect for moms cookbook DIY projects or anyone passionate about preserving family traditions
• Durable Design Features: Constructed with a 300gsm cardstock cover and matte lamination, this cookbook you can write in ensures longevity. Its spiral-bound format provides convenient access to pages, making it a practical tool for everyday use
• Organized Recipe Storage: The included memo pocket offers a space to store handwritten notes or recipe cards, enhancing its functionality. This feature transforms the recipe book for moms into a sentimental family memento
• Ample Writing Space: Measuring 6.5 x 8.2 inches, this blank spiral family recipe cookbook offers plenty of room for detailed notes. It is perfect for jotting down ingredients, preparation methods, and serving suggestions for a complete culinary record

$7.98

Buy on Amazon

Correct redirects generated by Nginx itself

Some redirects never reach the application. Nginx can generate absolute redirects for its own processing, and two core settings determine which host appears.

server_name_in_redirect

server_name_in_redirect controls whether an absolute redirect uses the primary name from the selected server block or the host supplied by the request. If the block’s primary name is an internal or old hostname, Nginx can expose it even though the browser requested the public name. Review this setting together with the ordering and contents of server_name.

absolute_redirect

absolute_redirect controls whether Nginx emits absolute URLs in redirects. When the deployment requires relative redirects, disabling absolute redirects can avoid a host being inserted by Nginx. This is a policy decision: relative locations are less explicit for clients and do not replace a correctly configured canonical hostname.

These directives affect redirects that Nginx constructs; they do not rewrite an application’s response. If the bad host is already present in an upstream Location, use the header and application fixes described earlier.

Implement intentional www/non-www canonicalization in separate blocks

Canonicalization is different from preserving the host. If the site deliberately chooses one public name, make that policy explicit and keep the redirect-only server separate from the application proxy.

server {
    listen 80;
    server_name old.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.example.com;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://app_backend;
    }
}

Add equivalent redirect blocks for every alternate name you intentionally support, such as the non-www HTTPS name. Ensure that the destination block does not redirect back to the source. Keep certificates valid for every HTTPS name that must receive a redirect; a browser must complete TLS before it can follow the HTTP response.

Use an explicit return 301 rather than an if-based host switch inside the main proxy block. Separate server blocks make the policy visible to Nginx’s virtual-server selection and avoid a cumbersome, ineffective conditional redirect pattern.

Preserve scheme and port across TLS termination

A common arrangement terminates TLS at Nginx and sends plain HTTP to the application. Without the original scheme, the application sees an HTTP request and may redirect to HTTP even though the visitor used HTTPS. Set X-Forwarded-Proto $scheme and configure the application to trust it.

Port errors follow the same pattern. A backend listening on 8080 is not evidence that the public URL uses 8080. Forward or configure the external port separately, and make sure the application generates URLs from the external port rather than its listening socket. Test both the default HTTPS port and any deliberately exposed alternate port.

Diagnose common loops and wrong-host symptoms

HTTPS to HTTP and back again

If the browser requests HTTPS, Nginx forwards HTTP, and the application redirects to HTTPS repeatedly, the application is not recognizing the forwarded scheme or does not trust the proxy. Confirm the header at the application boundary and its trusted-proxy setting. Do not add another Nginx redirect until the application reports HTTPS for the original request.

www and non-www alternate

Inspect each hop with curl -I -L. If both server blocks issue 301 responses, choose one canonical destination. The canonical block should serve the request directly; only the alternate block should redirect.

The old hostname appears only after login

Basic pages may be relative while the authentication system constructs an absolute callback URL. Check the login response’s Location, then verify that the application receives the public Host, X-Forwarded-Host, and X-Forwarded-Proto. If those values are correct but the response remains wrong, apply a narrowly scoped proxy_redirect or correct the application’s external-base-URL setting.

The proxy works by IP but not by name

An IP request may fall into the default server while the named request matches a different block. Compare the two requests with explicit Host values and inspect nginx -T. Correct the matching server_name and default arrangement rather than changing upstream headers.

The fix appears ineffective

Run nginx -t before reloading. A successful syntax test does not reload workers, so apply the configuration with your service manager’s reload operation, then repeat the same curl command. If command-line results are correct but a browser still jumps to the old host, remember that browsers can cache 301 responses. Test in a clean session or with a new path only after the server-side chain is verified.

Validate and roll out the change safely

1. Save the current configuration or use your normal version-control checkpoint.
2. Run nginx -t and fix every reported error before reloading.
3. Reload Nginx using the method appropriate to your installation.
4. Repeat curl -I -L https://public.example/path for a normal page, a login endpoint, and a path that previously exposed the wrong host.
5. Check that the final status is the expected application response, that every intermediate Location uses the intended scheme and host, and that no private hostname or backend port leaks.
6. Test alternate names, HTTP-to-HTTPS behavior, and any nonstandard public port you support.

Only after these checks should you clear browser or intermediary caches. A cached permanent redirect can conceal a successful server change or make a repaired endpoint appear broken.

Quick Recap

Bestseller No. 1

Recipe Book to Write in Your Own Recipes, Spiral Blank Cookbook 150 Recipes

$14.98

Bestseller No. 2

Pipilo Press Blank Family Cookbook Recipe Binder - 6.5 x 8.2 in Hardcover Spiral Bound - 90 Ruled Pages with Memo Pocket - Write In Your Own Recipes & Meal Planning Notebook

$7.98

Choose the smallest fix that matches the evidence

Final troubleshooting checklist

• Have you recorded the first incorrect Location header rather than only the final URL?
• Does nginx -T show the expected server_name, listen port, TLS block, and default-server behavior?
• Does the proxy send Host $host when the application must know the public hostname?
• Are X-Forwarded-Proto and, where needed, X-Forwarded-Host present and trusted only from Nginx?
• Does an upstream absolute location require a narrowly matched proxy_redirect rule?
• Are Nginx-generated absolute redirects consistent with server_name_in_redirect and absolute_redirect?
• Is canonical www/non-www behavior implemented by one-way, separate server blocks?
• Did nginx -t, reload, and a fresh multi-hop curl test all succeed before relying on browser results?

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.