Answer a few questions and get a clean, commented nginx server block. It covers static sites, single-page apps, reverse proxies (with WebSockets and load balancing) and PHP-FPM, plus HTTPS with modern TLS settings, redirects, gzip, caching and security headers.
Last updated:
Generated configuration
Advertisement
Advertisement
How to use the Nginx Config Generator
Choose the site type: static files, a single-page app (React, Vue, Angular), a reverse proxy to an app server, or PHP.
Enter your domain names and the document root or backend address.
Set up HTTPS: keep Let's Encrypt paths or enter your own certificate files, and pick HTTP/2, HSTS and the www redirect you want.
Tune performance and security: gzip, asset caching, security headers, upload limit and custom redirects.
Copy or download the config, save it in /etc/nginx/sites-available/ or /etc/nginx/conf.d/, run sudo nginx -t and reload nginx.
How nginx picks a location
Inside a server block nginx chooses one location per request. Knowing the order avoids most "why is this rule ignored?" problems:
Exact matchlocation = /path wins immediately.
The longest prefix match is remembered. If it uses ^~, it wins and regexes are skipped.
Regular expressions~ (case-sensitive) and ~* (case-insensitive) are checked in the order they appear in the file; the first match wins.
If no regex matches, the remembered longest prefix (for example location /) is used.
Common nginx directives
Directive
Purpose
server_name
Host names this server block answers. Use _ as a catch-all.
root / index
Folder that holds the files, and the file served for a directory request.
try_files $uri $uri/ /index.html
Try the file, then the folder, then fall back to index.html (SPA routing).
return 301 https://$host$request_uri
Permanent redirect that keeps the path and query string.
proxy_pass http://127.0.0.1:3000
Forward the request to an app server. With a URI part, the matched prefix is replaced.
proxy_set_header
Pass Host, client IP and protocol to the backend.
expires 30d
Sets Expires and Cache-Control: max-age for browser caching.
add_header … always
Add a response header, also on error pages. Headers are not inherited by a location that defines its own add_header.
client_max_body_size 20M
Largest upload allowed (default 1 MB, larger requests get 413).
gzip on
Compress text responses; add the MIME types in gzip_types.
Troubleshooting checklist
Always test first: sudo nginx -t prints the file and line of any syntax error. Reload with sudo systemctl reload nginx so running connections are not dropped.
502 Bad Gateway: the backend is not running or listens on a different port or socket. Check it with curl http://127.0.0.1:3000 on the server and read /var/log/nginx/error.log.
403 Forbidden on a static site: the nginx user (www-data or nginx) needs read access to the files and execute access to every parent folder.
Default page still shows: remove or disable sites-enabled/default, or make sure your server_name matches the domain you are requesting.
Redirect loop behind a load balancer or Cloudflare: the proxy talks to nginx over HTTP, so redirecting to HTTPS loops. Use the proxy's HTTPS settings or check $http_x_forwarded_proto.
Frequently asked questions
Where do I put the nginx config file?
On Debian and Ubuntu, save it as /etc/nginx/sites-available/example.com.conf and symlink it into /etc/nginx/sites-enabled/. On RHEL, Fedora, Alpine and the official Docker image, save it in /etc/nginx/conf.d/ with a .conf extension. Then test with sudo nginx -t and apply with sudo systemctl reload nginx.
How do I redirect HTTP to HTTPS in nginx?
Add a server block that listens on port 80 for your domains and contains return 301 https://$host$request_uri; (or your canonical domain instead of $host). The generator creates this block when you enable HTTPS and the redirect option.
How do I make nginx serve a React or Vue single-page app?
Use try_files $uri $uri/ /index.html; in location /. Requests for real files are served directly and every other path falls back to index.html, so the client-side router can handle it. Choose the Single-page app type to get this plus sensible caching.
What headers should a reverse proxy pass to the backend?
At least Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto, so the app knows the original host, client IP and whether the request used HTTPS. For WebSockets you also need proxy_http_version 1.1 and the Upgrade and Connection headers.
Why does nginx -t fail with a certificate error?
The ssl_certificate files must exist before nginx loads the config. Get the certificate first (for example sudo certbot certonly --nginx -d example.com), or start with HTTPS turned off, obtain the certificate, then enable HTTPS.
Should I use listen 443 ssl http2 or http2 on?
Since nginx 1.25.1 the http2 parameter of listen is deprecated in favour of the separate http2 on; directive. Use the new syntax on current nginx and the legacy syntax only for older versions such as 1.18 or 1.22 shipped by some distributions.
Is anything sent to a server?
No. The configuration is generated in your browser and your settings are only saved in this browser's local storage.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.