Set the fallback explicitly on the listen directive, not with server_name _; alone. Put the fallback in its own server block, add default_server to every IPv4 and IPv6 socket that should use it, and then choose whether unmatched requests should be closed with 444, answered with an error such as 404, or served an isolated static page.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Nginx does with an unmatched domain
Nginx makes its virtual-host decision in two stages. It first selects the listening address and port from the listen directives. It then compares the request’s Host value with the server_name values attached to servers on that socket.
As an Amazon Associate I earn from qualifying purchases.
For named hosts, Nginx checks exact names first. If there is no exact match, it checks the longest leading wildcard, then the longest trailing wildcard, and finally the first matching regular expression. If no name matches, the request goes to the default server for that address and port. A request without a Host header also reaches that per-port default.
This is why an unknown domain can unexpectedly display your first configured website: when no server is explicitly designated, the first server listed for the matching address and port becomes the default. Nginx’s official guide describes that first-listed behavior and recommends the default_server parameter when you want the choice to be unambiguous.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The minimal HTTP fallback
Create a separate server block and mark it as the default on every HTTP socket that is exposed. A common dual-stack configuration is:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}The two listen lines cover IPv4 and IPv6 independently. The default_server parameter is the control that selects this block when no named server matches. The underscore is only a conventional invalid name; it is not a wildcard and does not, by itself, catch every domain.
| Directive | Purpose |
|---|---|
listen 80 default_server; |
Makes this block the fallback for IPv4 traffic on port 80. |
listen [::]:80 default_server; |
Makes it the fallback for IPv6 traffic on port 80. |
server_name _; |
Uses a conventional name that should not intersect with a real domain; it does not perform the fallback selection. |
return 444; |
Closes an unwanted request instead of returning a normal HTTP response. |
Choose what the fallback should return
Close the connection with status 444
return 444; is useful when unknown hosts should receive no page and no ordinary HTTP status. Nginx closes the connection for this response. It is commonly used to avoid exposing a real site’s content to arbitrary host headers.
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}Return a normal error status
If clients, monitoring systems, or an upstream proxy need a conventional HTTP response, return an error status instead:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 404;
}This keeps the fallback behavior explicit while allowing the caller to receive a standard not-found response. Select the status that matches your logging, proxy, and operational requirements.
Serve an isolated fallback page
You can point the default block at a small static site rather than one of the production virtual hosts. Keep its content and document root separate from named sites so an unknown host cannot accidentally expose another site’s files.
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /var/www/fallback;
index index.html;
}The fallback page should be intentionally minimal. Do not copy a production site’s root or application settings into this block unless you specifically want unknown domains to reach that application.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Why server_name _; is not a catch-all
The underscore is often shown in examples because it is an invalid-looking name that will not normally match a real host. Nginx documentation notes that there is nothing special about it; it is simply one of many invalid domain names. Its presence does not change the server-selection algorithm.
If you write server_name _; but omit default_server from the relevant listen directive, another block can remain the default. In that situation, an unknown domain may still be served by the first-listed server. The fallback property belongs to the listening socket, not to the spelling of server_name.
For requests that arrive without a Host header, Nginx also documents an empty-name pattern:
server {
listen 80;
server_name "";
return 444;
}An empty server_name matches requests without a Host header. This pattern addresses missing headers specifically; an explicitly marked default server remains the clear way to control all otherwise unmatched names on that socket.
Keep real sites in their own server blocks
Each real site should declare the names it is intended to answer, while the fallback remains isolated:
server {
listen 80;
listen [::]:80;
server_name game.example.com www.game.example.com;
root /var/www/game;
index index.html;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}With this arrangement, requests for either listed game domain use the named server. A different Host value, including a typo or an unrelated domain pointed at the same address, uses the fallback instead. The named block does not need to enumerate every possible invalid host.
Default servers are separate for every address and port
A default on port 80 does not automatically become the default on port 443, 8080, or another listening socket. Nginx assigns the default-server property per address and port. If your machine accepts HTTPS, create and mark an HTTPS fallback separately.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
For example:
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
return 444;
}The certificate paths shown are example paths. Replace them with certificates and keys that are valid for your deployment, and include the TLS settings required by that deployment.
Why HTTPS needs special attention
For HTTPS, server selection can begin during the TLS handshake using SNI, before Nginx processes the HTTP Host header. The certificate and TLS settings in the HTTPS default block therefore matter even when the eventual policy is to close unknown requests.
A client that sends an SNI name matching a configured HTTPS server can be directed there during the handshake. A client with an unrecognized SNI name, or one that does not provide SNI, uses the default TLS server for that socket. After the handshake, Nginx applies the HTTP host-name selection rules. Treat the port-443 fallback as a complete TLS server, not as an HTTP block copied onto a different port.
Configure the fallback safely
- Create a dedicated server block. Keep the fallback separate from every real site’s configuration so changing one site cannot silently change the policy for unknown hosts.
- List each socket explicitly. Add
default_serverto the IPv4 and IPv6listendirectives you actually expose. Repeat the process for HTTPS and any other port that needs an independent fallback. - Choose the name convention. Use
server_name _;for a conventional invalid name, or use the empty-name form when you are deliberately handling requests with no Host header. Neither spelling replaces the default flag. - Choose one response policy. Use
return 444;to close unknown-host connections, an error status such asreturn 404;for a normal HTTP response, or a small isolated document root for a landing page. - Review the named servers. Confirm that each production hostname appears in the intended
server_namelist and that wildcard patterns are no broader than necessary. - Validate the effective configuration. Use the normal configuration-check and reload workflow for your Nginx deployment after editing. This confirms that the file is accepted and that duplicate socket declarations have not created a configuration error.
- Exercise both matching and unmatched paths. Request a configured hostname, an unrelated hostname pointed at the same address, and a request path with no Host header where your client can generate one. Check that each reaches the intended block and response policy.
Matching precedence you need to remember
When several named blocks could match, Nginx does not simply choose the last file loaded. Its documented order is:
- an exact
server_name; - the longest leading wildcard, such as
*.example.com; - the longest trailing wildcard, such as
mail.*; - the first regular expression that matches.
Only after these name checks fail does Nginx use the default server for the selected address and port. This distinction helps diagnose a fallback that appears not to work: a broad wildcard or regular expression may be matching the request before the default is considered.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and their fixes
The underscore block is never used
Symptom: an unknown domain still displays a real site.
Cause: the fallback has server_name _; but no default_server on the matching listen directive, so the first-listed server remains the default.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Fix: add default_server to the appropriate socket and ensure no other block claims the same default.
Two blocks claim the same default
Symptom: configuration validation reports a duplicate default for an address and port.
Cause: more than one server block is marked default_server for the same listening socket.
Fix: leave exactly one default block for that address and port. If IPv4 and IPv6 are both used, each family needs one deliberate default, but they must not be duplicated within the same socket.
IPv6 behaves differently from IPv4
Symptom: unknown domains are rejected over IPv4 but reach a real site over IPv6, or the reverse.
Cause: only one address family has an explicitly marked default.
Fix: configure and review both listen 80 default_server; and listen [::]:80 default_server; when both are exposed. Apply the same check to port 443.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
HTTP is protected but HTTPS is not
Symptom: an unknown HTTPS domain shows an unintended certificate or site even though HTTP has a fallback.
Cause: the port-80 default does not govern port 443, and TLS selection occurs during the handshake.
Fix: create a separate HTTPS default block with valid certificate and key paths, mark both 443 sockets as default where applicable, and set the desired response policy there.
A wildcard captures the request first
Symptom: a request you expected to reach the fallback is answered by a wildcard server.
Cause: Nginx’s name-matching precedence finds a leading wildcard, trailing wildcard, or regular expression before it considers the default.
Fix: inspect the names and patterns in the other server blocks. Narrow an overly broad pattern or add the intended exact name so the match is deliberate.
Choosing a policy for unknown hosts
| Policy | Configuration | Use it when |
|---|---|---|
| Close the connection | return 444; |
Unknown hosts should not receive a normal page or status response. |
| Return an HTTP error | return 404; or another selected error status |
Clients, proxies, or monitoring need a conventional HTTP result. |
| Serve an isolated page | A separate fallback document root and index | You want a controlled landing page without exposing a production site’s files. |
The important design decision is to make the behavior intentional. Leaving the first-listed server as an accidental fallback can expose the wrong site’s content whenever a DNS record, proxy, scanner, or malformed request reaches the address with an unexpected host value.
Quick Recap
Operational checklist
- One deliberate default server exists for each exposed address-and-port combination.
- IPv4 and IPv6 sockets have been considered separately.
- Port 443 has its own default block and certificate configuration.
- Production hostnames are listed only in the server blocks that should answer them.
- No wildcard or regular-expression name is broader than intended.
- The fallback action is explicit: close, return an error, or serve an isolated page.
- The effective configuration has passed the deployment’s normal validation and reload process.
- Tests cover a known hostname, an unmatched hostname, and a missing-Host request where applicable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
