Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →An Nginx 301 is a permanent redirect, not a file-delivery error. The response tells the requesting browser or crawler to fetch a different URL, shown in the Location header. Find which rule or upstream produced that header before changing configuration: run curl -IL https://files.example.com/assets/app.css, inspect the active configuration with nginx -T, and watch the error log while making one request. The fix may be a misplaced canonical-host redirect, an unintended rewrite, an error_page mapping, a try_files fallback, or an application behind proxy_pass.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a 301 means when another site requests a file
HTTP status 301 means “Moved Permanently.” Nginx is instructing the client to request another URL instead of returning the requested image, stylesheet, JavaScript file, PDF, or download directly. The destination is in the Location response header. A redirect can change the scheme (HTTP to HTTPS), hostname, path, or trailing-slash form.
As an Amazon Associate I earn from qualifying purchases.
Cross-domain loading does not inherently require a redirect. A page on game.example can request an asset from files.example; Nginx still selects a server block and location from the requested hostname and URI. If the request receives 301, a configuration rule or an upstream application chose that response. CORS headers address whether browser scripts may read a response; they do not turn a 301 into a successful file response.
Start with the response, not the configuration edit
- Request headers and follow every hop. Run
curl -IL https://files.example.com/assets/app.cssThe first status is the response from the initial request. Record every
Locationvalue that follows. Usecurl -Iwithout-Lwhen you need to inspect only the first response. - Classify the redirect. Note whether the destination changes HTTP to HTTPS, one hostname to another, the path, or only a trailing slash. A host or scheme change usually points to canonicalization; a path change often points to a rewrite, application route, or slash policy.
- Reproduce the exact asset URL. Test the same extension, capitalization, query string, and hostname used by the other site. Nginx location matching and filesystem mapping can differ for a seemingly similar URL.
- Inspect the merged configuration. As an administrator, run
nginx -TThis prints included files and the effective configuration. Identify the selected
listen,server_name, exactlocation, and anyreturn,rewrite,error_page,try_files,root,alias, orproxy_passdirective that can handle the request. - Watch the error log during one request. Use the error-log path configured for the relevant server and make a single
curlrequest. Rewrite-loop messages, file-not-found details, and upstream connection information can identify the stage at which the response changes.
Do not infer the current server response from a browser that may have cached a permanent redirect. Use curl while troubleshooting, then clear the browser or site cache after the server returns the intended status.
#1 Best Overall
How Nginx chooses the rule that returns 301
Nginx first selects a server block using the listening address, port, and requested host. It then chooses the most specific matching location. A redirect in a broad or default server block can therefore run before the location you expected to serve a static file. The file’s origin being “another site” does not bypass this routing process.
Host-wide canonical redirects
A common mistake is placing a canonical-host redirect in the same server block that should serve assets. For example, a block that returns every request to https://www.example.com$request_uri will also redirect /assets/app.css. If the asset hostname is meant to remain separate, give it its own server_name and server block.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Immediate return directives
return stops request processing and sends the specified status and URL immediately. It is the clearest choice for a simple, fixed redirect, but its scope matters. A return 301 at server level affects all matching requests; one inside a narrow location affects only that location.
Pattern-based rewrite directives
rewrite transforms a URI when a regular expression matches. The permanent flag produces a 301. Flags such as last start a new location search, while break keeps processing in the current location. A rule intended as an internal mapping can accidentally become an external redirect if it uses permanent or if the replacement is an absolute URL.
error_page mappings
An error_page directive can route a missing-file or other error to a URI that itself returns 301. The original request may look like a redirect even though the first trigger was a 404 or another status. Inspect all inherited and included error_page directives when the requested file is absent.
Upstream applications
When a location uses proxy_pass, the application can generate the 301. Frameworks commonly canonicalize a host, scheme, slash, or route. Compare the proxied URL with a local static-file test before editing Nginx rules; changing Nginx cannot remove a redirect that the upstream sends intentionally.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Serve a local asset without redirecting it
For a file stored on the Nginx host, use root or alias to map the URI to disk and use try_files to make the missing-file behavior explicit. The root directive appends the request URI to its directory. With root /srv/www/files;, a request for /assets/app.css maps to /srv/www/files/assets/app.css.
This is a narrow example for an asset hostname:
server {
listen 80;
server_name files.example.com;
root /srv/www/files;
location /assets/ {
try_files $uri =404;
}
}try_files $uri =404; checks whether the mapped file exists and returns a hard 404 when it does not. It prevents a missing asset from falling through to an application route that might issue a 301. Confirm that the Nginx worker can traverse the directories and read the file; a permissions problem can look like a missing file and trigger the fallback you are trying to avoid.
When to use alias
alias replaces the matching location prefix rather than appending the complete URI. Its path and trailing-slash form must match the location design. If a location is location /assets/, an alias such as alias /srv/static/; maps /assets/app.css to /srv/static/app.css. Verify the resulting path on disk before blaming redirects.
Separate a hostname migration from the asset server
If an old hostname really must redirect permanently, isolate that behavior in its own server block. Keep the canonical or file-serving hostname in a block that has no host-wide redirect:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsserver {
listen 80;
server_name old.example.com;
return 301 https://new.example.com$request_uri;
}
server {
listen 80;
server_name files.example.com;
root /srv/www/files;
location /assets/ {
try_files $uri =404;
}
}The first block intentionally redirects every request for old.example.com. The second serves files for files.example.com. If clients still receive 301, confirm that DNS points to the intended Nginx instance and that the request’s Host header matches the asset server’s server_name.
Choose return, rewrite, or an internal mapping correctly
| Need | Directive or approach | Expected client result | Typical mistake |
|---|---|---|---|
| One fixed destination for a host or narrow path | return 301 https://new.example.com$request_uri; |
One explicit permanent redirect | Putting it at server level when only one location should redirect |
| Regex-based public URL transformation | rewrite with a deliberate flag such as permanent |
Redirect only when the pattern matches | Using permanent for a mapping that should remain internal |
| Serve an existing local file | root or alias with try_files |
200 for a readable file; explicit 404 when absent | Falling through to an application route that returns 301 |
| Change processing without a new location search | rewrite ... break |
No external redirect from the rewrite itself | Using last and re-entering a location with another rewrite |
Nginx processes rewrite directives sequentially. Repeated rewrites are limited to ten cycles; a chain that keeps sending the URI back through matching locations can end in a 500 error. Simplify the rules, make each pattern more specific, and use break when a new location search is not intended.
Check whether try_files is handing the request to an application
try_files can test several candidates and then internally redirect to a URI or named location. A configuration such as try_files $uri $uri/ /index.php; sends a missing asset to the application. If that application canonicalizes the request, the browser sees its 301 rather than a file response.
Temporarily test the asset location with an explicit status:
Recommended Free Tools
location /assets/ {
try_files $uri =404;
}If the response becomes 404, Nginx is not finding the file at the path you expected. Correct the root or alias, filename, case, or permissions. If the file then returns 200, decide whether a separate application fallback is appropriate for other URLs; do not send static assets through that fallback merely to avoid checking the filesystem.
Investigate hotlink protection without mistaking it for authentication
Referer-based hotlink controls commonly use valid_referers and the $invalid_referer variable. They can allow requests from selected sites and deny others in a narrow asset location:
location ~* .(gif|jpe?g|png|webp|css|js|pdf)$ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) { return 403; }
try_files $uri =404;
}This example uses 403 for a disallowed referrer, not 301. If your policy instead redirects invalid requests, that redirect is the source of the observed 301 and should be changed deliberately. Keep the location’s extensions and permitted hostnames specific to your site.
The Referer header is optional: privacy settings, browser policies, extensions, and some direct clients omit it. It is also forgeable. A request with an allowed referrer is not proof that it came from that site, and a request with no referrer is not necessarily malicious. Treat this mechanism as traffic control, not authentication or access control for confidential files.
Test each referrer case
- Test without a referrer:
curl -I https://files.example.com/assets/app.css - Test a permitted referrer:
curl -I -e https://allowed.example/page https://files.example.com/assets/app.css - Test a disallowed referrer:
curl -I -e https://other.example/page https://files.example.com/assets/app.css
Compare the status and Location header. Differences show policy behavior; they do not establish the identity of the requesting site.
When another site receives a different result than curl
Browsers may send a Referer that your command-line test does not. Conversely, a browser may omit it because of its referrer policy. Test both cases explicitly before changing hotlink rules.
A cached 301 can survive after the configuration is fixed. Check the response with curl against the live hostname, inspect the date and server headers if present, and clear the browser’s site data or use a fresh profile for confirmation. Also check intermediary caches or a CDN if the DNS name does not point directly at this Nginx server; a cache can replay an older permanent redirect even after the origin is correct.
Common failure modes and precise fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Every asset, including existing files, redirects to one hostname | Host-wide return in the default or canonical server block |
Create separate server_name blocks and keep the asset hostname free of the migration redirect. |
| Only missing files return 301 | try_files falls through to an application or named location |
Verify the mapped path and use try_files $uri =404; for the static location. |
| The path gains or loses a slash, or changes extension | rewrite rule or application canonicalization |
Find the matching regex in nginx -T; remove permanent when an internal mapping was intended, or correct the application route. |
| A 404 becomes a 301 | An error_page maps the error to a redirecting URI |
Remove the redirect mapping or return an explicit status when a hard 404 is required. |
| Requests bounce between URLs and eventually fail | Rewrite rules re-enter locations in a loop | Make patterns mutually exclusive, reduce the chain, and use break where no new location search is needed. |
| Only requests from another site behave differently | Referer policy, browser cache, or different host/scheme | Repeat tests with no, allowed, and disallowed referrers; inspect every Location; clear cached redirects. |
| Nginx configuration appears correct but 301 persists | Upstream application or a different server/CDN answers the request | Check proxy_pass, upstream logs, DNS, and the selected server block before editing the static-file rules. |
Verify the repair safely
- Validate syntax before reloading:
nginx -t - Reload Nginx using your operating system’s service manager only after the test succeeds.
- Request the exact asset with
curl -ILand confirm that no unexpectedLocationheader remains. A correctly found local file should normally produce 200; a deliberately absent file should produce the status you configured, commonly 404. - Repeat with the hostname, scheme, path, query string, and referrer used by the external site.
- Watch the error log for one request and confirm that no rewrite loop, permission error, or upstream redirect is involved.
- Load the asset from a clean browser session after command-line tests pass. If a browser still follows 301, clear its cached permanent redirect and retest.
A compact decision path
- Location changes host or scheme: inspect canonical redirects and server-block selection first.
- Location changes only the path or slash: inspect
rewrite, application routes, and slash handling. - Only absent files redirect: inspect
root,alias,try_files, anderror_page. - Only cross-site requests differ: test
Referervariations and browser caching; do not treat referrer data as identity. - Static tests work but proxied requests redirect: investigate the upstream application and proxy chain.
The reliable fix is to identify the first 301 response, map it to the exact Nginx or upstream directive, and narrow that directive to the requests that are genuinely meant to redirect. Serve local assets with an explicit filesystem mapping and fallback status, isolate hostname migrations, and use referrer rules only as a limited traffic-control measure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Frequently Asked Questions
Can a 301 be caused by CORS when another website embeds my CSS or image?
No. CORS controls whether browser code may read a response; it does not create the HTTP 301. Inspect the response’s Location header and the Nginx or upstream rule that generated it.
Why does curl show 200 while the browser still follows a 301?
The browser may have cached an earlier permanent redirect or may be sending a different Host, scheme, path, or Referer header. Compare the exact request and clear the browser’s site data before retesting.
Should hotlink protection redirect unauthorized requests?
Usually use an explicit denial such as 403 in the asset location. A redirect can hide the policy’s purpose and create extra requests. In either case, remember that Referer is optional and forgeable, so it is not authentication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
