What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If www.example.com shows the wrong site, NGINX is usually routing the request to a different virtual server, or DNS is sending the hostname to another machine. NGINX first selects a listening address and port, then compares the HTTP Host header with each block’s server_name. If nothing matches, the default_server for that port handles the request. HTTPS adds TLS SNI and a separate port-443 configuration, so a working port-80 block does not prove that 443 is correct.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use this order: verify every DNS answer, inspect the configuration NGINX actually loaded with nginx -T, make the exact hostname unique on both ports, define an intentional fallback, test with nginx -t, reload, and verify each address with hostname-preserving requests.
As an Amazon Associate I earn from qualifying purchases.
How NGINX decides which server block receives www
A server block is selected in stages. NGINX first uses the destination IP address and TCP port from the connection. Within that listen group, it examines the request’s Host header and compares it with server_name values. Exact names take precedence over wildcard names, and wildcard names take precedence over regular expressions. If no name matches, NGINX uses the default server assigned to that address and port.
The default is not a property of a domain name. It belongs to a particular listening port. If no block includes default_server, the first block loaded for that listen address and port becomes the implicit default. Consequently, the first file in an include sequence can appear to “win” even though another file contains the intended domain.
#1 Best Overall
For HTTPS, TLS negotiation happens before NGINX can process the HTTP request. The client sends the requested hostname through Server Name Indication (SNI), allowing NGINX to choose a TLS context and certificate. After the handshake, the HTTP Host header is used for normal virtual-host routing. A wrong 443 default can therefore present another site’s certificate, another site’s content, or both.
1. Verify DNS before editing NGINX
First establish that the public hostname reaches the machine whose configuration you are changing. Check A records for the apex and www, and check AAAA records as well. A stale address, a second web server, a CDN or load balancer, or an IPv6 path can make a correct local configuration look ineffective.
Compare all returned addresses
Resolve both names from a network path similar to the affected visitor. For example:
dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A
dig +short www.example.com AAAAEvery returned address should be expected. If an old IPv4 address remains, remove or update that DNS record. If an AAAA record points somewhere different, either configure that IPv6 listener and server block or correct the record. Test from more than one network when split-horizon DNS, enterprise DNS, or a resolver cache may be involved.
Distinguish DNS from local routing
When you know the correct server IP, force the hostname to that address while retaining the original host and SNI values:
curl -I --resolve www.example.com:80:203.0.113.10 http://www.example.com/
curl -Ik --resolve www.example.com:443:203.0.113.10 https://www.example.com/If the forced request reaches the right site but the ordinary request does not, fix DNS, the front-end proxy, or the load balancer rather than changing the origin’s server blocks. Repeat the test for each A and AAAA address that public DNS returns.
Recommended Free Tools
2. Inspect the configuration NGINX actually loaded
Editing a file is not the same as changing the running configuration. Distribution packages commonly include files from several directories, and generated or containerized deployments may write a different file than the one you opened.
Run:
sudo nginx -TThe -T option performs a configuration test and then dumps the complete configuration, including included files. Save or search this output for every occurrence related to the hostname:
listen 80andlisten 443, including address-specific listeners and IPv6 listeners.server_name example.com www.example.comand any other occurrence of either name.default_server, wildcard names such as*.example.com, and regular-expression server names.returnandrewritedirectives that may redirect the request elsewhere.proxy_set_header Hostand related proxy settings when NGINX forwards to an application.- The
root,proxy_pass, certificate, and log paths in the block you expect to handle the request.
Inspect the output rather than relying on a directory listing. The effective order, include path, and duplicate definitions are what matter.
3. Give the exact hostname one authoritative HTTP block
For a site served directly on port 80, declare both the apex and www names explicitly when both should reach the same site:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /srv/www/example;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}Replace the document root and locations with those used by your application. The important routing line is server_name; it must contain the hostname the browser sends. A block that names only example.com does not claim www.example.com.
Remove competing names
Search the full nginx -T output for every exact occurrence of www.example.com. Remove an accidental duplicate from another file or give that other block a different name. Also inspect broad wildcards and regular expressions. Exact names have higher matching priority, but duplicate exact names create an operational conflict: the result depends on the loaded configuration and ordering. Keep one authoritative owner for each hostname on each listen port.
Check address-specific listeners
listen 80; and listen 203.0.113.10:80; are not interchangeable when the server has multiple addresses. Confirm that the address receiving DNS traffic has the intended block. Do the same for [::]:80; an IPv6 request can enter a different listener or even reach another machine if the AAAA record is wrong.
4. Make the fallback deliberate
Unknown hosts should not silently display a customer site or an unrelated application. Create a separate catch-all for each protocol and address family. A minimal HTTP fallback is:
Rank #3
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}The underscore is a conventional dummy name; the important setting is default_server. NGINX uses this block only when no more specific server name matches that listen port. A 444 response is an NGINX-specific connection close. If your monitoring or clients require a normal status, use a deliberate 4xx response or a neutral document instead.
Do not redirect every unknown host to a trusted domain by default. An arbitrary Host value can be supplied by a client, and a blanket redirect can create confusing behavior or abuse. Redirect only when the destination and policy are explicit.
5. Configure HTTPS independently
Port 443 needs its own correct block, certificate, and fallback. A typical block serving both names is:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
root /srv/www/example;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}The certificate must cover every hostname clients request. One certificate with both names in its Subject Alternative Name list is a common arrangement; separate certificates and blocks are also valid. The certificate path shown above is an example path, not a guarantee that your certificate issuer uses that directory.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why HTTP can work while HTTPS is wrong
Port 80 and port 443 have separate listen groups and defaults. A correct HTTP block does not affect a 443 request. During the TLS handshake, SNI may select a certificate from a different 443 block before the HTTP Host header is available. If the wrong certificate appears, inspect the 443 server_name, listen, default_server, and certificate directives first.
If you want one canonical hostname, use a small HTTP redirect block and a content-serving HTTPS block, or place both names in the HTTPS block and redirect only the non-canonical name. Do not assume that a redirect in the port-80 block fixes a certificate mismatch on port 443; the TLS certificate must still be valid for the name the client requested.
Optional HTTPS catch-all
Define an intentional 443 fallback as well. It must have a certificate suitable for the behavior you want, because TLS validation occurs before an HTTP redirect can be returned:
Rank #4
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
ssl_certificate /etc/ssl/certs/fallback-fullchain.pem;
ssl_certificate_key /etc/ssl/private/fallback-key.pem;
return 444;
}Use a certificate and key that exist and are readable by NGINX. If a client requests an unknown hostname, it may reject the fallback certificate before receiving the 444 response; that is expected for an intentionally rejected host.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Validate, reload, and confirm the running process
Never reload an untested configuration. Run:
sudo nginx -tThis checks syntax and attempts to open referenced files, including certificates and keys. Correct every reported error before proceeding. Typical failures include a missing semicolon, an unreadable certificate, a nonexistent include file, or a duplicate listen option that conflicts with the deployment.
After a successful test, perform a graceful reload:
sudo nginx -s reloadA service manager’s reload command is equivalent when it targets the same NGINX installation and master process. A reload applies the new configuration without terminating existing connections immediately. If the response does not change, verify that the command used the same binary and configuration path as the running master, then rerun nginx -T with the appropriate privileges.
7. Test the hostname, port, certificate, and redirect
Test ordinary public resolution first:
curl -I http://www.example.com/
curl -Ik https://www.example.com/Inspect the status code, Location header, Server header, and (for HTTPS) the certificate presented by the endpoint. A 301 or 308 may be correct if it matches your canonical-host policy; a redirect to an unexpected domain points to a return, rewrite, application setting, or upstream response that still needs correction.
Then test each known address while preserving the hostname and SNI:
curl -I --resolve www.example.com:80:203.0.113.10 http://www.example.com/
curl -Ik --resolve www.example.com:443:203.0.113.10 https://www.example.com/Compare the forced and ordinary results. If only one address is wrong, correct that DNS target, listener, load-balancer route, or origin. If every address is wrong in the same way, inspect the loaded NGINX configuration and the application behind it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Use logs to identify the block handling the request
Tail the access and error logs while reproducing the request. The log file receiving the request can reveal that traffic is entering a default block, an old virtual host, or a different container. Check timestamps, client address, requested host, status, and upstream information.
For a temporary diagnostic, add a distinctive response header to the intended block:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalladd_header X-Debug-Vhost example-www always;Reload after nginx -t succeeds, make one test request, and remove the header when finished. Do not leave internal topology or debugging identifiers exposed permanently. If the header never appears, the request is not reaching that block; return to DNS, listen addresses, duplicate names, and the 443 SNI path.
Choose the intended host and protocol policy
Fixing the routing error is separate from deciding what the site should do with each hostname. Choose one policy and encode it consistently.
| Policy | HTTP behavior | HTTPS behavior | Configuration implication |
|---|---|---|---|
| Serve both names | Both names serve the same application or content. | Certificate covers both names; both are listed on the 443 block. | Keep one authoritative block per port containing both exact names. |
| Canonical apex | www redirects to the apex, or both HTTP names redirect to HTTPS first. |
www redirects to the apex; apex serves content. |
Use a dedicated redirect block and a certificate valid for the requested name. |
| Canonical www | The apex redirects to www. |
The apex redirects to www; www serves content. |
Keep www in the serving block and retain certificate coverage for the apex redirect. |
| Reject unknown hosts | Catch-all returns 444 or another intentional 4xx. | Catch-all has a usable TLS context, then rejects the request. | Mark the fallback default_server separately on each port. |
Do not mix policies accidentally—for example, redirecting the apex on port 80 while serving both names on 443 without deciding which URL should be indexed or shared. The redirect target, status code, and certificate coverage should agree with the selected policy.
Common causes and targeted fixes
| Symptom | Likely cause | Targeted check |
|---|---|---|
www shows the default site on HTTP. |
No exact server_name match, or the intended file is not included. |
Search nginx -T for www, then verify the port-80 listen group. |
The apex works but www does not. |
The block names only the apex. | Add www.example.com or create its deliberate redirect block. |
| HTTP is correct; HTTPS shows another certificate. | Wrong 443 default, missing 443 name, or SNI reaches another address. | Use curl -Ik and --resolve; inspect 443 blocks and certificate paths. |
| Only some visitors see the wrong site. | Different A or AAAA answers, resolver caches, or a front-end node differs. | Compare every DNS answer and test each address directly. |
| Changes have no effect after reload. | Edited file is not included, reload targeted another instance, or an upstream generates the response. | Compare the edited file with nginx -T and inspect logs during a request. |
| A redirect leads to an unexpected domain. | A return, rewrite, application canonical URL, or proxy response is active. |
Search loaded directives and inspect the Location header. |
| IPv4 works but IPv6 is wrong. | AAAA points elsewhere or the IPv6 listener has a different default. | Test the AAAA address and inspect listen [::] blocks. |
When a CDN, load balancer, or container is in front
There may be more than one routing decision. The public DNS name can terminate at a CDN or load balancer, which then selects an origin. Verify the edge’s hostname mapping and certificate before changing the origin. If the edge forwards a different Host header, configure it to preserve the public hostname or make the origin block match the header it actually sends.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIn containers, the host NGINX configuration and the container’s generated configuration may be different. Run nginx -T inside the process that serves the request, not merely on the host. Confirm published ports, mounted certificate files, and the container receiving traffic. Regeneration tools can overwrite manual edits, so make the authoritative change in the template or deployment definition.
Quick Recap
Final troubleshooting checklist
- Resolve A and AAAA records for the apex and
www; account for every returned address. - Use
curl --resolveto separate DNS or front-end problems from origin routing. - Run
sudo nginx -Tand inspect included files, listen groups, names, defaults, redirects, and proxy headers. - Ensure one authoritative exact
server_nameowner exists for each hostname on port 80 and port 443. - Check IPv4 and IPv6 listeners independently.
- Configure an intentional catch-all with
default_serveron each relevant port. - Give HTTPS a matching 443 block and a certificate covering every requested name.
- Run
sudo nginx -t; fix every syntax or file error. - Reload with
sudo nginx -s reload. - Test ordinary requests and every DNS address, checking status, redirects, headers, logs, and the presented certificate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
