The reliable production pattern is to terminate TLS at Nginx (or another reverse proxy) on your VPS, forward requests to Gunicorn or Uvicorn, and configure Django to trust the proxy’s HTTPS signal. Point your domain’s DNS to the VPS, allow TCP ports 80 and 443, obtain an ACME certificate with Certbot, redirect HTTP to HTTPS, then enable Django’s secure-cookie and CSRF protections.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This arrangement keeps Django’s development server off the public internet while protecting credentials, session cookies and password-reset tokens in transit. The steps below assume a Linux VPS, a domain you control, and an application already served locally by Gunicorn or Uvicorn.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What the finished setup looks like
A browser connects to https://your-domain.example on port 443. Nginx performs the TLS handshake and serves the certificate. It then proxies the decrypted HTTP request over the VPS loopback interface or a Unix socket to Gunicorn or Uvicorn, which runs Django. Django generates the response, Nginx encrypts it again, and the browser receives it over HTTPS.
Browser ── HTTPS :443 ──> Nginx ── local socket/127.0.0.1 ──> Gunicorn or Uvicorn ──> Django
Browser ── HTTP :80 ──> Nginx ── permanent redirect to https://your-domain.exampleDo not expose python manage.py runserver directly to the internet. It is a development server, not a hardened public-facing service.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Responsibilities by layer
| Layer | What it must do |
|---|---|
| DNS | Resolve the application hostname’s A record (and, if used, AAAA record) to the VPS addresses. |
| Firewall | Allow inbound TCP 80 for HTTP and ACME HTTP-01 validation, and TCP 443 for HTTPS. Keep the application port or socket private. |
| Nginx | Serve the certificate on 443, redirect 80, preserve the original host, and send a correct X-Forwarded-Proto value. |
| Gunicorn/Uvicorn | Listen on a Unix socket or localhost port and pass requests to Django. |
| Django | Accept only intended hostnames, recognize trusted proxied HTTPS, and mark session and CSRF cookies as secure. |
Before changing anything: prerequisites and a rollback point
Collect the production details
- The exact public hostname, including whether you will use
www, the bare domain, or both. - The VPS public IPv4 address and, if configured, its IPv6 address.
- The Gunicorn or Uvicorn systemd service name, listening socket or localhost port, and the Django settings module used in production.
- The Nginx site file that currently handles the domain.
- The Linux distribution’s firewall and any separate firewall controls supplied by the VPS provider.
Back up the current state
Copy the active Nginx site file and main configuration before requesting a certificate. Record the status of Nginx and the application service so you can distinguish a pre-existing outage from a TLS change. Keep the backup outside the directory that automated tools may rewrite. A rollback should be as simple as restoring the previous site file, running nginx -t, and reloading Nginx.
Check the application locally
From the VPS, confirm that the upstream responds on its socket or localhost port. If Nginx cannot reach Gunicorn or Uvicorn before TLS is added, certificate work will not fix the underlying upstream, permission, or service problem.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPoint DNS at the VPS and open the required ports
DNS records
Create an A record for the hostname that users will enter. Create an AAAA record only when IPv6 is configured end to end: the VPS must have a working IPv6 address, Nginx must listen on it, and the firewall must allow 80 and 443 over IPv6. A stale AAAA record can make some visitors reach the wrong machine even when IPv4 works.
Wait for the record to resolve publicly, then verify both the name and the address from a network outside the VPS. Do not request a certificate until the name resolves to this server; the ACME authority validates control of the hostname, not merely ownership of the VPS.
Firewall and reachability
Allow inbound TCP 80 and 443 in both layers of filtering: the operating-system firewall and any provider-level firewall. HTTP-01 validation normally needs port 80, even if every human visitor will ultimately be redirected to HTTPS. Leave Gunicorn/Uvicorn’s port inaccessible from the public internet; it should accept traffic only from Nginx or the local host.
Test that an ordinary HTTP request reaches Nginx. If another virtual host answers, fix the server-name selection before issuing the certificate. A different site intercepting the hostname can also intercept the ACME challenge.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Obtain and install a certificate with Certbot
Certbot can use an Nginx plugin to request a certificate and edit the matching server block. Use the package supplied for your Linux distribution or the installation method documented by Certbot, then request certificates for every hostname that the site will serve. A typical command, after replacing the example names, is:
sudo certbot --nginx -d your-domain.example -d www.your-domain.exampleThe Nginx plugin is convenient when Nginx is already the public listener. Other ACME challenge methods may fit a different network design. Standalone mode temporarily runs its own listener and therefore also needs port 80 available; stop or reconfigure the existing listener only as the client documentation directs.
Protect certificate material
Certbot keeps live certificate paths under /etc/letsencrypt/live/, with private keys among the linked files. Keep those keys readable only by the services that need them, and never copy them into the Django repository, a container image, a backup shared with developers, or a public static directory. The certificate’s hostname must match the hostname in the browser; a valid certificate for a different name is still a browser error.
Review automated edits
Read the Nginx configuration after Certbot finishes. Confirm that the intended server block owns the certificate, that the upstream remains your actual Gunicorn/Uvicorn socket, and that the HTTP block redirects rather than serving a second copy of the application. Automated edits are not a substitute for checking the complete request path.
Configure Nginx for HTTPS and a safe proxy boundary
The HTTPS server block
The following is a pattern, not a drop-in file. Replace the domain and upstream path, and retain any required static or media locations from your existing deployment.
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name your-domain.example www.your-domain.example;
ssl_certificate /etc/letsencrypt/live/your-domain.example/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/your-domain.example/privkey.pem;
location / {
proxy_pass http://unix:/run/gunicorn/your-app.sock;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}proxy_set_header Host $host preserves the hostname Django uses for host and CSRF checks. The HTTPS block explicitly sets X-Forwarded-Proto https because this request really arrived over TLS. Nginx should overwrite, not blindly pass through, a client-supplied forwarding header.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
The HTTP redirect block
server {
listen 80;
listen [::]:80;
server_name your-domain.example www.your-domain.example;
return 301 https://$host$request_uri;
}Redirecting at Nginx avoids sending an insecure request through the application stack and is the preferred performance path. Keep the redirect permanent only after you have tested the HTTPS site; browsers cache permanent redirects aggressively.
ACME challenge handling
If you use HTTP-01 validation, ensure that requests to /.well-known/acme-challenge/ can reach the ACME client. A catch-all redirect is usually compatible, but a different server block, access rule, or application route can intercept the challenge. When port 80 cannot reach the VPS, use a DNS-01 method supported by your ACME client and DNS provider instead of weakening the firewall.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSet Django’s HTTPS and host settings
Allow only the real hostnames
Set ALLOWED_HOSTS to the names users should be able to request. Include every hostname that Nginx accepts and no wildcard unless you have a specific, controlled reason.
ALLOWED_HOSTS = [
'your-domain.example',
'www.your-domain.example',
]Tell Django when the request was really HTTPS
Behind a reverse proxy, Django sees the proxy-to-application connection, which may be plain HTTP even though the browser used HTTPS. If, and only if, your proxy sets the header correctly and exclusively for HTTPS requests, add:
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')This setting is a trust decision. It is safe only when an untrusted client cannot inject a false value and when the proxy sends the header consistently. An incorrect value can cause redirect loops or make Django treat an insecure request as secure.
Redirect and cookie protections
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = TrueNginx should normally perform the site-wide redirect. SECURE_SSL_REDIRECT remains useful when a front-end redirect is unavailable or as an additional application control, provided the proxy header is correct. Secure cookies prevent browsers from sending session and CSRF cookies over HTTP. A login-capable site should enforce HTTPS because credentials, session cookies and password-reset tokens can otherwise travel in clear text. Django’s security documentation states: “It is always better for security to deploy your site behind HTTPS.”
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
CSRF trusted origins and hostname consistency
If the application receives CSRF-protected POST requests on specific HTTPS origins, list those origins explicitly:
CSRF_TRUSTED_ORIGINS = [
'https://your-domain.example',
'https://www.your-domain.example',
]Use the exact scheme and hostname that browsers use. A mismatch between the login URL, form action, cookie domain, and Nginx server_name can look like a random CSRF failure when it is actually an origin inconsistency.
Add HSTS only after HTTPS is stable
HTTP Strict Transport Security tells browsers to use HTTPS automatically. Enable it only after every required hostname works reliably over HTTPS and you have a recovery plan. A typical Django configuration is:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = TrueDo not enable subdomains or preload casually. HSTS can make a broken certificate, forgotten subdomain, or temporary HTTP-only endpoint difficult to recover from because browsers will refuse HTTP before the request reaches your server.
Apply changes without taking down the site
- Run
sudo nginx -t. Do not reload if the test reports a syntax error, duplicate directive, missing certificate file, or invalid upstream. - Reload Nginx with
sudo systemctl reload nginx. A reload lets existing connections finish while workers read the new configuration. - Restart or reload Gunicorn/Uvicorn only when its service or environment actually changed. TLS termination belongs to Nginx, so a certificate renewal normally does not require a Django restart.
- Inspect Nginx’s error log and the application service log for permission errors on the Unix socket, an unreachable upstream, certificate-read failures, or an unexpected server block.
- Run Django’s deployment checks with the production settings, for example
python manage.py check --deploy --settings=your_project.settings.production.
Verify the complete HTTPS behavior
Test redirects and the certificate
- Request the HTTP URL and confirm it returns a redirect to the equivalent HTTPS URL, preserving the path and query string.
- Open the HTTPS URL for every hostname in the certificate and verify that the browser reports the expected name and a valid chain.
- Check that the certificate actually served on port 443 is the newly installed one, not an older certificate from another server block or load balancer.
- Test IPv4 and IPv6 separately when both DNS record types exist.
Test application security
- Log in and inspect the session cookie: it should include the
Secureattribute. - Inspect the CSRF cookie and submit a real CSRF-protected POST, such as a profile update, rather than testing only a GET page.
- Confirm Django no longer reports an insecure request when the browser used HTTPS.
- Search templates, JavaScript, CSS, settings, and stored content for absolute
http://references. Replace them with HTTPS or scheme-relative application URLs as appropriate. - Load static and media files through HTTPS and check browser developer tools for mixed-content warnings.
Make certificate renewal automatic and observable
Certbot installations commonly use a systemd timer or cron job. Verify that the timer or scheduled job exists, is enabled, and runs under an account that can read the certificate directories. The renewal command should be safe to run repeatedly; it renews only when the certificate is eligible according to the ACME client’s policy.
Perform a documented dry run or other safe renewal test supported by your installed client. A successful renewal is not enough if Nginx continues serving the old certificate: configure a post-renewal deploy hook that reloads Nginx, then verify the served certificate after the test.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo certbot renew --dry-runKeep the previous Nginx configuration available. If a renewal hook introduces a syntax error, restore the known-good file, run nginx -t, reload, and investigate the hook before attempting another production renewal.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the failures people see most often
Infinite HTTP-to-HTTPS redirect loop
The usual cause is that Django does not see the proxy’s HTTPS signal, or Nginx sends X-Forwarded-Proto https on requests that arrived over HTTP. Confirm that the HTTPS server block sets the header, the HTTP block redirects before proxying, and SECURE_PROXY_SSL_HEADER exactly matches the header name and value. Fix the trust boundary before disabling redirects; disabling them can leave part of the site accessible over clear text.
CSRF rejection or login failure after enabling HTTPS
Check CSRF_COOKIE_SECURE, SESSION_COOKIE_SECURE, CSRF_TRUSTED_ORIGINS, and hostname consistency. Make sure the browser is not switching between the bare domain and www, and that Nginx preserves the original host. Proxy-header mistakes can affect CSRF protection because Django uses the perceived scheme and host when evaluating requests.
ACME certificate challenge fails
Recheck A and AAAA records, port 80 reachability from the public internet, both firewall layers, and the Nginx server block selected for the hostname. Confirm that no other site intercepts /.well-known/acme-challenge/. If HTTP-01 cannot reach this VPS by design, use DNS-01 rather than repeatedly retrying the same unreachable challenge.
Mixed-content warnings remain
HTTPS on the top-level page does not encrypt an image, script, stylesheet, API call, iframe, or font loaded from an http:// URL. Update hard-coded URLs in templates and JavaScript, generated settings, and database-stored content. Then clear cached assets and retest the pages that produced warnings.
Recommended Free Tools
Renewal succeeds but visitors see the old certificate
Inspect the certificate served on port 443 and compare its dates and hostname with the renewed file under /etc/letsencrypt/live/. If the files differ, the deploy hook may not have reloaded Nginx, Nginx may reference another certificate path, or a second proxy may terminate TLS upstream. Run nginx -t, reload the correct service, and test again from outside the VPS.
Choosing an alternative TLS terminator
Nginx with Certbot is a transparent, widely documented arrangement, but it is not the only one. A different reverse proxy or a managed edge service can also terminate TLS. Evaluate the boundary carefully rather than choosing only by convenience.
| Decision point | Nginx plus Certbot on the VPS | Other reverse proxy or managed edge |
|---|---|---|
| Where TLS terminates | On the VPS’s Nginx listener. | On the selected proxy, which may be the VPS or an external edge. |
| Validation | Usually DNS points to the VPS and port 80/443 are reachable; HTTP-01 is straightforward when port 80 is open. | May require provider-specific DNS validation, edge routing, or an origin certificate. |
| Renewal and reload | You must verify the Certbot timer and Nginx reload hook. | May be automatic, but confirm how and when the origin configuration is updated. |
| Proxy headers | You control Host, X-Forwarded-For, and X-Forwarded-Proto directly. |
Document exactly which headers reach Django and which intermediary is trusted. |
| Rollback | Restore the Nginx file and certificate path on the VPS. | May involve both edge settings and origin configuration. |
| Network compatibility | Works when the VPS firewall, DNS, and IPv6 setup are under your control. | Check compatibility with the VPS firewall, origin restrictions, and IPv6 behavior. |
Regardless of the terminator, Django still needs correct host validation, trusted-proxy settings, secure cookies, CSRF origins, and mixed-content cleanup.
Quick Recap
Operational checklist
- DNS A and any intended AAAA records resolve to the VPS.
- TCP 80 and 443 are allowed through every firewall layer.
- Gunicorn or Uvicorn is private and healthy.
- Certificate and private key paths are correct and protected.
- HTTP redirects to the equivalent HTTPS URL.
- Nginx sets
Hostand an accurateX-Forwarded-Proto. ALLOWED_HOSTSlists the real names.SECURE_PROXY_SSL_HEADERis used only with a trustworthy proxy header.- Session and CSRF cookies are secure, and required HTTPS origins are trusted.
- Static, media, templates, JavaScript, and stored content contain no insecure subresource URLs.
- Django deployment checks pass.
- Renewal scheduling, dry-run testing, and the Nginx reload hook are verified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
