Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesInstall the certificate issued for your WordPress hostname, concatenate the server certificate and intermediate bundle in that order, reference the resulting PEM file and its matching private key in an NGINX listen 443 ssl; server block, test and reload NGINX, then change WordPress’s canonical URLs to https://. Keep the private key restricted, retain an HTTP listener for a deliberate redirect, and verify the complete chain, redirects, administration, media, and externally loaded assets.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What you need before changing NGINX
Have all of these items available before editing the live configuration:
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
- A certificate issued for the exact hostname or hostnames your visitors use. The certificate may cover one name, a wildcard name, or several names listed as SANs; the names must match the WordPress URLs and any aliases you intend to serve.
- The private key generated with the certificate-signing request (CSR). This must be the key that corresponds to the issued leaf certificate.
- Every intermediate certificate bundle supplied by the certificate issuer. NGINX uses this chain when it sends certificates to clients.
- Shell access with permission to read the NGINX configuration and reload the service, plus a way to recover the previous working configuration if validation fails.
- The hostname that will be canonical for the site, such as
example.comorwww.example.com. Decide this before writing redirects so HTTP and HTTPS do not point at different canonical names.
The certificate file is public: NGINX sends it to every connecting client. The private key is a secret and must be stored in a file that only the NGINX master process and approved administrators can read.
Identify the certificate, bundle, and key files
Server (leaf) certificate
The issued server certificate is commonly delivered as a .crt or .pem file. NGINX’s ssl_certificate directive expects PEM-encoded certificate data. If the file contains a different encoding, convert it to PEM with the certificate authority’s documented tooling before using it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Intermediate bundle
The bundle contains the intermediate certificates between your server certificate and a trusted authority. A browser or operating system may not already have the intermediate, so omitting it can produce an incomplete-chain warning even when the issuing authority itself is trusted.
Matching private key
The key created for the CSR is usually a .key file. NGINX’s ssl_certificate_key directive must point to this PEM-encoded key. Do not substitute a key from another certificate request, and do not upload the key to a public document directory.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build one chain file in the required order
NGINX expects the server certificate first and the intermediate certificates immediately after it. Create a combined file without changing either certificate’s PEM blocks:
cat example.com.crt bundle.crt > example.com.chained.crtIf the issuer supplied more than one intermediate file, append them in the order specified by that issuer:
cat example.com.crt intermediate-1.crt intermediate-2.crt > example.com.chained.crtKeep the original files until the installation has been verified. The file named by ssl_certificate should be the newly concatenated chain file, not the leaf certificate by itself. Reversing the order is a common cause of a private-key mismatch: NGINX examines the first certificate in the file when checking the key, so putting a bundle first can make it test the key against the wrong certificate.
Store files with safe ownership and permissions
Place the chain and key in a directory intended for TLS material rather than inside WordPress’s web root. The exact NGINX account varies by distribution, so inspect the service configuration and grant the master process read access without making the key world-readable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
- Keep the chained certificate readable by NGINX; it is public data.
- Restrict the private-key file to the administrator and the NGINX master process. A mode such as
600is appropriate when the file owner is the account that starts NGINX; use the ownership and group required by your operating system. - Do not solve a permission error by making the key world-readable. Correct the owner, group, directory traversal permissions, or service account instead.
- Back up the previous configuration and record the certificate expiry date so renewal can be planned before replacement is needed.
Configure the HTTPS server block
Add or edit the virtual host that serves the WordPress hostname. The modern NGINX form puts ssl on the listen directive:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php index.html;
ssl_certificate /etc/nginx/tls/example.com.chained.crt;
ssl_certificate_key /etc/nginx/tls/example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}Replace the document root, PHP-FPM socket, hostnames, and file paths with the values used by your installation. The important TLS directives are:
| Directive | Purpose |
|---|---|
listen 443 ssl; |
Accept HTTPS connections on port 443 using TLS. |
server_name |
Select the virtual host for the requested hostname. |
ssl_certificate |
Send the PEM chain whose leaf certificate comes first. |
ssl_certificate_key |
Load the matching PEM private key. |
ssl_protocols TLSv1.2 TLSv1.3; |
Enable the protocol versions shown in NGINX’s configuration example. |
NGINX documentation lists TLS 1.2 and TLS 1.3 as defaults beginning with version 1.23.4, but your installed NGINX and OpenSSL build may differ. An explicit protocol list makes the intended policy visible; confirm that both versions are supported on the system before reloading.
Keep port 80 for a controlled redirect
Port 80 can redirect visitors to HTTPS or remain available when a deployment requires HTTP coexistence. A typical canonical redirect is:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}Choose one canonical hostname and use it consistently. If www.example.com is canonical, redirect both names to that host instead. The $request_uri variable preserves the path and query string, so a request such as /wp-admin/ reaches the same path over HTTPS. Do not create separate rules that alternately add and remove www; that pattern causes redirect loops.
Some sites intentionally serve HTTP for a local service, health check, or staged migration. In that case, keep a clear HTTP server block for that purpose and avoid applying a blanket redirect until every client and integration can use HTTPS.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Test and reload NGINX safely
- Check the syntax and referenced files before touching the running service:
sudo nginx -tThe command must report a successful syntax test. Errors identify the file and line that need correction.
- If the test reports a missing file, verify the absolute paths, spelling, and directory permissions for both the chained certificate and key.
- If the test reports a key mismatch, confirm that the leaf certificate is first in the chain file and that the key came from the CSR used for that certificate.
- Reload only after the test succeeds:
sudo systemctl reload nginxA reload applies the new configuration without needlessly stopping existing connections. Use the service manager appropriate to your operating system if it is not systemd.
- Keep the previous configuration available until HTTPS, redirects, and WordPress administration have all been tested.
Change WordPress’s canonical URLs
WordPress is compatible with HTTPS when a TLS/SSL certificate is installed and available to the web server. It still needs its own canonical URLs changed from HTTP to HTTPS.
Use the WordPress dashboard
- Sign in to the dashboard over the new HTTPS address.
- Open Settings → General.
- Change both WordPress Address (URL) and Site Address (URL) to the same HTTPS hostname, for example
https://example.com. - Save the changes, sign in again if WordPress ends the session, and confirm that the dashboard remains on HTTPS.
Set the values in configuration when the dashboard is inaccessible
If the old URL causes a loop or prevents login, set the values temporarily in wp-config.php before the line that says to stop editing:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Use the exact canonical hostname selected in NGINX. Once access is restored, keep one authoritative source for these values so an administrator does not later overwrite them with HTTP in the dashboard.
Update stored content and integrations
Changing the two URL settings does not rewrite every absolute URL stored in posts, widgets, theme options, or plugin settings. Search for the old http:// hostname in content and configuration, then replace it with the HTTPS hostname using a migration method that understands serialized WordPress data. Review external services such as payment callbacks, webhooks, feeds, XML sitemaps, and API clients individually; each may have its own registered URL.
Verify the complete installation
Test from a normal browser and from a shell outside the server:
- Open both the bare hostname and every intended alias. Confirm that the certificate’s names match the address in the browser.
- Inspect the certificate chain in the browser’s security panel. The server certificate should be followed by the supplied intermediates, with no incomplete-chain warning.
- Request an HTTP URL and confirm it makes one intentional redirect to the canonical HTTPS URL while retaining its path and query string.
- Open the WordPress login, dashboard, front page, representative posts, media library, and a page containing forms or scripts. Check that every address remains HTTPS.
- Use the browser’s developer console to locate mixed-content requests. Replace hard-coded HTTP image, stylesheet, script, font, iframe, and AJAX URLs with HTTPS or protocol-appropriate URLs.
- Check that canonical tags, Open Graph URLs, feeds, XML sitemaps, and robots directives use the chosen HTTPS hostname.
- Confirm that scheduled jobs, REST API clients, webhooks, and third-party integrations can reach the new URL and are not pinned to the old HTTP address.
For a basic TLS handshake check, you can inspect what the server presents with:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
openssl s_client -connect example.com:443 -servername example.com -showcertsThe output should show the expected leaf certificate and the intermediate certificates from the chain file. The command does not replace browser testing, because WordPress redirects and page assets are application-level behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot the failures that appear most often
NGINX says the private key does not match
First verify that the key belongs to the issued leaf certificate, not to an earlier CSR. Then open the chained file and ensure the leaf PEM block appears before every intermediate. A bundle placed first makes NGINX compare the key with the bundle’s first certificate.
Browsers report an incomplete chain
Rebuild the file referenced by ssl_certificate with the leaf certificate followed by all intermediate certificates supplied by the issuer. Reload NGINX after a successful syntax test. A client may lack an intermediate even when it trusts the issuing authority, so sending the chain from the server is necessary.
NGINX cannot read the key
Check the key’s owner, group, mode, and every parent directory’s execute permission for the NGINX master process. Restore restricted access after correcting those settings; do not make the key publicly readable.
The browser still shows HTTP content
Mixed content usually comes from an absolute HTTP URL retained in a post, theme, plugin, stylesheet, script, font, iframe, or AJAX call. Find the exact request in developer tools, update its stored URL, clear the relevant cache, and test again. A page can have a valid certificate and still be blocked from loading insecure subresources.
WordPress redirects repeatedly
Compare the hostname and scheme in NGINX redirects with the two WordPress URL settings. If TLS terminates at a CDN or reverse proxy before NGINX, verify that the proxy sends a trustworthy HTTPS indicator and that the origin handles it exactly once. A common PHP configuration for a trusted proxy is:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO']) {
$_SERVER['HTTPS'] = 'on';
}Use this only when the header is set by infrastructure you control; accepting an arbitrary client-supplied header can undermine scheme detection. The proxy, NGINX, and WordPress must agree on which layer performs the canonical redirect.
Only one hostname works
Check that every intended name appears in the certificate and in the appropriate server_name directives. A certificate for one name cannot authenticate an unlisted alias. Add a separate certificate or obtain a certificate whose SAN or wildcard coverage includes the required names, then test each name independently.
Choose certificate coverage and deployment topology deliberately
| Choice | Coverage decision | Operational point to confirm |
|---|---|---|
| Single-name certificate | One specific hostname | The certificate, redirect target, and WordPress URLs all use that name. |
| Wildcard certificate | Subdomains represented by the wildcard name | Every subdomain you serve is within the certificate’s wildcard scope. |
| SAN certificate | Several explicitly listed hostnames | Each production alias is included in the certificate’s SAN list. |
| Origin NGINX terminates TLS | Visitors connect directly to NGINX on port 443 | NGINX owns the certificate, key, chain, redirects, and renewal reload. |
| CDN or reverse proxy terminates TLS | The proxy presents the public certificate | Origin scheme headers, redirect responsibility, and any separate origin certificate are documented. |
Regardless of coverage, confirm how the issuer supplies intermediates, how the private key is stored, how renewals replace the chain file, and which service reloads NGINX after renewal. A certificate that covers every name is still unusable if the origin receives the wrong scheme or cannot read the key.
Version and security details to keep current
Use listen 443 ssl; rather than the old standalone ssl on; directive. NGINX made the standalone directive obsolete in version 1.15.0 and removed it in version 1.25.1. Verify the installed NGINX and OpenSSL versions before copying a configuration from another server, especially when relying on protocol defaults.
Do not email or commit the private key to a public repository. Limit shell access to administrators who need it, monitor file changes, and remove superseded keys according to your organization’s retention policy. When a certificate is renewed, replace the chain and key as a matched pair, run nginx -t, reload NGINX, and repeat the hostname and chain checks.
Quick Recap
Final installation checklist
- The certificate names match every hostname users will visit.
- The chained PEM file contains the leaf certificate first and intermediates afterward.
ssl_certificatepoints to that chain andssl_certificate_keypoints to its matching key.- The key is readable by the NGINX master process but not by ordinary users or the web root.
nginx -tsucceeds before the service is reloaded.- Port 80 behavior is intentional and preserves the selected canonical hostname.
- Both WordPress URL settings use HTTPS, and stored content and integrations no longer depend on HTTP.
- Browser tests show a trusted chain, no mixed content, working login and administration, and no redirect loop.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
