To run Ghost at a subdomain such as blog.example.com, point that hostname to your Ghost deployment in DNS, configure Ghost with the complete HTTPS URL, and route traffic through a proxy that preserves the host and protocol. A self-hosted production install uses Ghost-CLI with NGINX, MySQL, systemd and TLS; Ghost(Pro) handles the server and automatically provisions SSL for a custom domain.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose how you will host Ghost
The subdomain setup depends first on whether Ghost runs on your own server or on Ghost(Pro). Both use the same basic URL pattern, but the operational work is different.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Area | Self-hosted Ghost | Ghost(Pro) |
|---|---|---|
| Server maintenance | You maintain the server, operating system, Ghost installation and supporting services. | The hosting provider operates the Ghost server for you. |
| NGINX and TLS control | Ghost-CLI can configure NGINX and SSL during a production installation; you control the proxy configuration. | The provider controls the proxy and certificate workflow; custom domains receive an SSL certificate automatically. |
| Upgrades | You are responsible for applying Ghost and server updates safely. | The managed service handles the platform upgrades according to its service operation. |
| DNS and proxy work | You create the DNS record and ensure your server’s NGINX proxy forwards the correct host and protocol. | You create the required DNS record and follow the provider’s custom-domain instructions. |
| Recurring hosting cost | Not stated in Ghost’s official configuration material; it varies by server provider and capacity. | Not stated in the official pages used here; consult the current Ghost(Pro) plan information before choosing it. |
If you want direct access to NGINX, TLS termination and the server, choose self-hosting. If you want Ghost without administering a server, choose Ghost(Pro). Do not mix the two deployment models: a Ghost(Pro) domain should point to the provider’s target, while a self-hosted domain should point to your own server.
What you need before creating the subdomain
- A registered domain, such as
example.com, with access to its DNS records. - A Ghost deployment: either a server prepared for a production Ghost installation or an active Ghost(Pro) publication.
- A subdomain name, for example
blog.example.com. The label can be different, but use one final hostname consistently. - Control of the proxy layer. In self-hosting this is normally NGINX; in Ghost(Pro) it is the provider’s proxy.
- An HTTPS certificate. Ghost recommends SSL for production, and Ghost(Pro) automatically issues one for a custom domain.
Decide the canonical address before installation. In the examples below it is https://blog.example.com. Ghost’s configured URL must include the scheme (https://) and the complete subdomain, not only the parent domain or a bare hostname.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Step 1: Create the subdomain DNS record
Self-hosted server
Open the DNS management screen for example.com and create a record for the host label blog. Point it to the public address of the server running Ghost. An A record is appropriate when you have an IPv4 address; an AAAA record can be added when the server is reachable over IPv6. If your server provider gives you a hostname instead of an address, use the CNAME target it specifies.
| DNS field | Example | Meaning |
|---|---|---|
| Type | A | Maps the subdomain to an IPv4 address. |
| Name/Host | blog |
Creates blog.example.com beneath the parent domain. |
| Value | Your server’s public IPv4 address | The destination that receives web requests. |
Use the equivalent CNAME form only when the target supplied by your hosting or proxy service is a hostname. Do not create conflicting A and CNAME records for the same name. DNS changes may take time to appear at different resolvers, so verify that the hostname resolves to the intended destination before troubleshooting Ghost itself.
Ghost(Pro)
In Ghost(Pro), start the custom-domain flow in the publication’s administration area and copy the DNS target it provides. Create the requested record at your domain registrar or DNS provider. The exact target is provider-specific, so do not substitute your own server address. Wait for the provider to recognize the record and issue the certificate.
Step 2: Install Ghost in production on your server
Use Ghost-CLI for a standard self-hosted deployment
Ghost-CLI is Ghost’s installation and configuration tool. Its production setup is designed to configure the components Ghost expects: MySQL, NGINX, systemd and SSL. Run the installation on the server in the directory where the publication should live, using the administrative account and permissions required by your operating system.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Connect to the server and install the current Ghost-CLI release according to Ghost’s official installation instructions.
- Create or select the directory that will contain the Ghost publication.
- Start the production installer with the Ghost-CLI installation command, typically
ghost install, from that directory. - When the installer asks for the publication URL, enter the complete canonical address:
https://blog.example.com. - Provide the database and administrator details requested by the installer. Allow it to configure the production service, NGINX and SSL when those prompts appear.
- Complete the setup and open
https://blog.example.com/ghost/to create or sign in to the publication administrator account.
The URL prompt is not cosmetic. Ghost uses it when generating links, loading assets and handling redirects. Entering http://blog.example.com, example.com or a temporary server address can leave the publication with mixed links or redirects that do not match the address visitors use.
If Ghost is already installed
Change the production URL in the Ghost configuration to the final HTTPS subdomain, then restart the Ghost service using the management method for your installation. The value must match the host visitors enter, including the subdomain and HTTPS scheme. Avoid changing the URL repeatedly while DNS and certificates are being issued; settle on one canonical hostname first.
Step 3: Configure NGINX as the reverse proxy
Ghost normally runs behind NGINX or another web proxy. The proxy accepts the public request on ports 80 and 443, serves or negotiates TLS, and forwards the request to Ghost’s local application service. Ghost-CLI can create this configuration, but you should still verify that the server block uses the intended hostname.
- The server name must include
blog.example.com. - HTTPS traffic must be accepted on the TLS listener.
- HTTP traffic must redirect to the same hostname over HTTPS.
- The proxy must preserve the original
Hostheader. - The proxy must tell Ghost that the original request used HTTPS, normally with
X-Forwarded-Proto: https.
That forwarded protocol is essential when TLS ends at NGINX or another load balancer. If the proxy sends an insecure protocol value, Ghost believes the visitor arrived over HTTP and attempts to redirect to HTTPS. The browser then follows the redirect back through the same proxy, producing an infinite redirect loop.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
When another proxy terminates TLS
A CDN, load balancer or hosting gateway can terminate TLS before forwarding to Ghost. In that arrangement, configure the outer proxy to send the original host and X-Forwarded-Proto: https to the next proxy or to Ghost. The inner NGINX configuration must trust and pass those headers rather than replacing them with an incorrect HTTP value. The public request should still be redirected from HTTP to the one HTTPS canonical URL.
Step 4: Enable and verify TLS
Self-hosted certificate
During a normal Ghost-CLI production installation, allow the tool to configure SSL after DNS points at the server. If you configure certificates separately, install the certificate and private key in the TLS proxy, ensure the certificate covers blog.example.com, and reload NGINX after the configuration is valid. Ghost’s production guidance recommends SSL; treat HTTPS as the default rather than an optional enhancement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ghost(Pro) certificate
Ghost(Pro) provides an SSL certificate automatically for a custom domain after the DNS record has been correctly configured and verified. The domain must still use HTTPS, and the provider’s reverse-proxy rules require an HTTP-to-HTTPS redirect plus correctly matched host and forwarding headers.
Check both protocols
Test the canonical address in a private browser window and also request the HTTP form. The HTTP form should make one clean redirect to https://blog.example.com; it should not bounce between hosts or schemes. Confirm that the browser shows a valid certificate for the exact subdomain, not merely for example.com.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Step 5: Test the complete publication
- Open
https://blog.example.com/and confirm the home page renders. - Open
https://blog.example.com/ghost/and sign in to the administration interface. - Load a post with its images, styles and scripts. A page that renders without CSS or images usually indicates an incorrect configured URL, proxy host or asset path.
- Create a test post or draft and upload an image. Verify that the upload completes and that the image URL uses the canonical HTTPS subdomain.
- Open the publication from a second network or device to rule out a local DNS cache.
- Test the bare parent domain and any old hostname. They should either remain separate sites by design or redirect to the canonical subdomain; do not leave multiple public addresses serving the same publication without a deliberate policy.
Check the browser’s network panel when a page is incomplete. Requests going to an old domain, an HTTP URL or a server address identify a URL or proxy mismatch rather than a content problem.
Keep one canonical URL
Ghost should have one authoritative URL, and every public route should converge on it. If visitors can reach the same publication at both http://blog.example.com and https://blog.example.com, redirect HTTP to HTTPS. If an additional hostname is accepted, redirect it to the canonical host instead of allowing two indexable copies of the site.
Set the canonical value in Ghost’s production configuration and match it in NGINX or the managed provider’s domain settings. A mismatch between Ghost’s configured URL and the proxy’s public host can affect generated links, admin login redirects, RSS links, images and social metadata.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common subdomain failures
The subdomain does not resolve
- Confirm the record name is
blog, not the full hostname duplicated inside a DNS interface that automatically appendsexample.com. - Check that the record points to the intended server or provider target and that no conflicting record exists.
- Allow time for DNS caches to expire, then test from a resolver or network that is not using an old cached result.
The browser reports a certificate error
- Verify the certificate includes
blog.example.com. - Ensure DNS points to the system that is issuing the certificate.
- Check that NGINX or the managed proxy is serving the new certificate on the HTTPS listener.
- Do not test only the parent domain; a certificate valid for
example.comdoes not automatically cover every subdomain.
There is an infinite HTTPS redirect loop
Inspect the forwarding headers first. When TLS terminates at a reverse proxy, Ghost must receive X-Forwarded-Proto: https. Also check that the outer proxy is not rewriting the host to an internal name and that only one layer is responsible for the HTTP-to-HTTPS redirect. Correct the header and reload the proxy before changing Ghost’s URL.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The home page works but /ghost/ or assets fail
Compare the failing request’s hostname and scheme with Ghost’s configured production URL. Confirm that NGINX forwards the original host, that the server block matches the subdomain, and that no old domain remains in the configuration. Recheck scripts, stylesheets and image uploads after correcting the URL.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Ghost(Pro) says the domain is not ready
Reopen the provider’s custom-domain instructions and compare the DNS record character for character with the supplied target. Remove conflicting records, wait for DNS recognition, and keep the domain on the HTTPS configuration required by the provider’s proxy rules.
Self-hosting or Ghost(Pro): a practical decision
- Choose self-hosting when you need control over NGINX, TLS termination, the database and the server environment, and you can handle maintenance and upgrades.
- Choose Ghost(Pro) when avoiding server administration is more important than controlling the underlying proxy and operating system.
- Use the same discipline either way: one DNS destination, one HTTPS canonical URL, correct host and protocol forwarding, and a complete test of the public site and
/ghost/.
The subdomain itself is only the DNS label. A reliable Ghost publication also depends on the URL configured inside Ghost, the proxy’s forwarding headers and a valid TLS certificate. Treat those as one chain: DNS sends the request to the right deployment, the proxy preserves what the visitor requested, and Ghost generates links for that same HTTPS address.
Frequently Asked Questions
Can I use a subdomain other than blog.example.com?
Yes. Use any available host label, such as news.example.com, but create DNS for that exact name and enter its complete HTTPS address as Ghost’s production URL.
Do I need both an A record and a CNAME record?
No. Use the record type appropriate to your destination: an A or AAAA record for your server address, or a CNAME when your hosting or proxy provider supplies a hostname target. Do not create conflicting records for the same subdomain.
Recommended Free Tools
Why does Ghost redirect forever after I add HTTPS?
The reverse proxy is usually failing to pass the original secure protocol. Ensure it forwards X-Forwarded-Proto: https and preserves the public host header.
Is Ghost(Pro) the same as installing Ghost on my own VPS?
No. Ghost(Pro) is managed hosting; self-hosting leaves server, NGINX, TLS and upgrade administration to you.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
