nginx Config Generator

Design and optimize production-ready Nginx server block configurations.

1. Server Info

Domain / Server Name

WWW Redirection

Application Type

2. Application Settings

Web Root Path

3. SSL Configuration

SSL Setup

SSL Profile (Mozilla)

Certificate Path (Optional)

Private Key Path (Optional)

Enable HTTP/2Enable HSTS (Strict-Transport-Security)

Include SubdomainsEnable HSTS Preload

4. Security & Optimization

Enable Gzip CompressionAggressive Static Assets CachingInject Core Security Headers

X-Frame-Options

Referrer Policy

X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=block

Generated nginx Configuration

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;

    # SSL Certificate Paths
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # SSL Profile: Intermediate
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    # Routing and Location Rules
    root /var/www/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # Cache Static Assets
    location ~* \.(?:css|js|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
        expires 30d;
        access_log off;
        add_header Cache-Control "public, no-transform";
    }
}

Understanding your generated nginx Configuration

Save this configuration inside your Nginx config path, normally at /etc/nginx/sites-available/example.com. Then create a symbolic link to activate it:

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

Always test your configurations using nginx -t prior to restarting or reloading Nginx to avoid server downtime. Apply changes safely via:

systemctl reload nginx

This configurator follows best practices, specifying modern SSL suites, HSTS protections, proxy caching, standard websocket upgrade parameters, and essential security headers like X-Frame-Options to lock down your deployments from common vulnerabilities.

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Producing a server block for a static site or a reverse proxy.
Getting the proxy header set right for an upstream application.
Producing an HTTP-to-HTTPS redirect block.
Getting a single-page-app fallback right, which is where most hand-written blocks go wrong.
Producing a reverse-proxy block for a Node or PHP upstream.

Frequently Asked Questions

What kinds of site can it configure?: A static root, a reverse proxy to an application port, PHP through FPM, and a pure redirect to another domain. Each produces the matching `location` blocks rather than a generic template you then have to edit.
What is the difference between the modern and intermediate TLS profiles?: Modern is TLS 1.3 only — the strongest, and it locks out older clients. Intermediate keeps TLS 1.2 with a safe cipher list and is the right default for a public site. They follow Mozilla's published configurations.
Do I need the websocket option for a proxy?: Only if the application uses them, but it costs nothing to include: it sets `Upgrade` and `Connection` headers on the proxied request. Without them the handshake fails and the connection falls back or drops, which is a confusing symptom to debug.
What does the real-IP option do?: Forwards the client address with `X-Real-IP` and `X-Forwarded-For`, so the application logs the visitor rather than the proxy. Behind a CDN you also need `set_real_ip_from` for its ranges, or you will trust a header anyone can send.
Should I enable HSTS preload straight away?: No. Preload is effectively irreversible — removal takes months to reach users — and it applies to every subdomain. Run with a short `max-age` first, confirm nothing on any subdomain needs plain HTTP, then extend and consider preloading.
How do I apply the generated file?: Save it under `sites-available`, symlink it into `sites-enabled`, then run `nginx -t` and reload. Always test before reloading — an invalid file makes nginx refuse to start, and the reload is where you find out.

Common errors and gotchas

Omitting the forwarded headers on a proxy, so the application sees the proxy's address as the client's.
Getting `try_files` wrong for a single-page app, which then 404s on a deep link.
Creating a redirect loop between the HTTP and HTTPS blocks.
Setting a very long cache time on files with no hash in their names.
Deploying without running the server's own config test, which catches most of this in a second.