Nginx not redirecting non-www to www

Question

I need my Nginx setup to redirect users to www.example.com if they type example.com in the browser. The reason is that our SEO consultant said there should be only one preferred domain, otherwise Google sees it as content duplication. Anyway . . .

So the point is, I also have SSL from Letsencrypt set up on the server, but I'm not able to achieve the redirect from example.com to www.example.com (the server accepts both the versions). Here's the configuration I'm using:

server {
    listen 80; 
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    server_name example.com www.example.com;
    root /home/my_site;
    index index.php index.html index.htm;

    # for letsencrypt
    location ~ /.well-known {
        allow all;
    }   

    location / { 
        try_files $uri $uri/ /index.php?q=$uri&$args;
    }   

    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        root /usr/share/nginx/html;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }
}

==== Update ====

I now changed my configuration to as advised by Tim (and I always to nginx -t and restart) in one of the answers to the following:

server {
    listen 80; 
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}    

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.example.com;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    root /home/ankush/wp_ankushthakur;
    index index.php index.html index.htm;

    # for letsencrypt
    location ~ /.well-known {
        allow all;
    }   

    location / {
        try_files $uri $uri/ /index.php?q=$uri&$args;
    }

    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        root /usr/share/nginx/html;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }
}

Here's the output of curl -k and access logs for all of the variations (I didn't build Nginx from source because I'm hoping for a simpler solution and don't want to mess up the server):

curl -k http://example.com
Curl output: 301 - Moved permanently
Access logs: "GET / HTTP/1.1" 301 194 "-" "curl/7.47.0"

curl -k http://www.example.com
Curl output: 301 - Moved permanently
Access logs: "GET / HTTP/1.1" 301 194 "-" "curl/7.47.0"

curl -k https://example.com
Curl output: 301 - Moved permanently
Access logs: "GET / HTTP/1.1" 301 194 "-" "curl/7.47.0"

curl -k https://www.example.com
Curl output: <Blank>
Access logs: "GET / HTTP/1.1" 301 5 "-" "curl/7.47.0"

Notice the last section, where the CURL output is blank and the access logs still give a permanent redirect.

Funnily enough, if I comment out the second server block and then restart Nginx, I end up with the opposite effect of what I wanted: www redirects to non-www! I'm surprised that's happening, because the HTTPS version of www.example.com isn't mentioned anywhere in this (third) version of the config.

Answer 1

It's probably because you are redirecting only on HTTP, but not on HTTPS. You should add a HTTPS to your redirecting vhost, and leave there only example.com name.

Furthermore, what you're doing is the opposite to what people actually do nowdays - the common approach is to bury the legacy www prefixes from the old era and use only simple domain names, without the www.

Answer 2

The key here is that you need to deal with four URLS - http and https versions of the www and non-www domains. Your problem is you're forwarding the http version of the www and non-www domain to the https://www domain, but your main server block is listening for both https://example.com and https://www.example.com

All you need to do is create a separate server block to forward the https://example.com to the https://www.example.com server. You need to include the https setup in this.

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  include snippets/ssl-example.com.conf;
  include snippets/ssl-params.conf;

  server_name example.com;
  return 301 https://www.example.com$request_uri;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  include snippets/ssl-example.com.conf;
  include snippets/ssl-params.conf;

  server_name  www.example.com;

  # Main server block for main server continues
}

Standard Example

I have a tutorial with downloadable config files. A standard example is below.

If this doesn't work for you curl each variation (http and https, www and non-www) with the -k option to show headers and edit your question to include them.

# Main server
server {
  server_name www.example.com;
  listen 443 ssl http2;
  # etc, add all locations, call PHP or servers, etc
}


# Forward http requests to https www server
server {
  listen       80;
  server_name  example.com www.example.com;
  return       301 https://www.example.com$request_uri;
}

# Forward https non-www requests to the https www server
# Requires https setup for this server
server {
  listen 443 ssl http2;
  server_name example.com;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

  return 301 https://www.example.com$request_uri;
}

Problem Solving The best way to diagnose problems are:

• use "curl -k" (show headers) on each of the domain variants, in conjuction with the access log. The http status codes returned tell you what's going on. 200 is the page, 301 is permanent redirect, 302 is temporary redirect
• Ensure Nginx has the headers_more module, which you can do by building Nginx from source, which is quite easy. This allows you to add https headers to the response. This is a great diagnostic tool. You can use statements like this to work out what blocks are being executed

add_header Z_DEBUG "location_name_or_message";

Answer 3

I was finally able to convince our SEO person to consider the non-www domain as primary. The configuration that worked to redirect www to non-www was as below. Although my attempt for achieving the reverse had a similar configuration, I'm not sure what was preventing it.

server {
    listen 80; 
    listen [::]:80;

    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    server_name www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    server_name example.com;

    root /home/mysite;
    index index.php;

    location ~ /.well-known {
        allow all;
    }

    location / {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        try_files $uri $uri/ /index.php?$query_string;
        set $path_info $fastcgi_path_info;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    }
}