3

I ran Pingdom test on my 1 plain html file site and I get F rating for this:

Remove the following redirect chain if possible:

http://example.com/
http://www.example.com/
https://www.example.com/

And the only redirect in my .conf I have is:

server {
  listen 80;
  server_name example.com;
  return 301 $scheme://www.example.com$request_uri;
}

Next block is SSL and and the rest.

server {
  listen 443 ssl http2;
  etc...
}

There are no other configs. All I need is to redirect non-www to www and always https only and pass the test.

Updated: Full .conf

server {
  listen 80;
  server_name example.com;
  return 301 https://www.example.com$request_uri;
}

server {
  listen 443 ssl http2;

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers 'EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5';
  ssl_dhparam /etc/nginx/ssl/dhparams.pem;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_stapling on;
  ssl_stapling_verify on;
  add_header Strict-Transport-Security max-age=15768000;

  root /var/www/example.com/htdocs;

  server_name example.com www.example.com;

  location / {
    autoindex on;
    try_files $uri $uri/ =404;
  }

  location ~* /img/.*\.gif$ {
    expires 30d;
    add_header Pragma public;
    add_header Cache-Control "public";
  }
}
  • 1
    Please post all relevant server definitions, in case there are some you haven't noticed that are relevant. For example, the www subdomain doesn't have a listener, but it may be picked up because it's the default site (first server in config by default I think). – Tim Feb 19 '17 at 23:58
  • Updated with full conf – user3108268 Feb 20 '17 at 9:39
0

Just change $scheme to https, I can't tell why that's there in the first place since you're unlikely to get anything other than http over port 80 unless your users are doing something weird.

EDIT: Add missing https->https redirect.

Didn't notice you don't actually have an explicit default_server. Go with something along the lines of:

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://www.example.com$request_uri;
}
server {
  listen 443;
  server_name example.com;
  return 301 https://www.example.com$request_uri;
}

Ashish's answer might work but I'd stay away from if as much as possible (read If is Evil).

  • I think you're missing a negation there. I'd say it's unlikely not to get http over port 80. – Jenny D Feb 20 '17 at 7:26
  • Hi, I did and it only removed http://www.example.com/ from the list and I still get an F. – user3108268 Feb 20 '17 at 9:36
  • also does not redirect from https://example.com to https://www.example.com – user3108268 Feb 20 '17 at 9:43
-1

I guess your godaddy cname or A records will be fine for nginx try the below code.

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    if ($http_x_forwarded_proto != 'https') {
          rewrite ^(.*) https://www.example.com$1 redirect;
    }
}

If you want to do it in one go then use this way but it is very bad way to solve this issue. Add map module on top of config and location block on server 80 block.

map $http_host $new {
    'www.abc.com' '1';
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    if ($http_x_forwarded_proto != 'https') {
        rewrite ^(.*) https://$host$1 redirect;
    }
    location / {
        if ($new != '1') {
            rewrite ^(.*) https://www.example.com$1 redirect;
        }
    }
}
  • what it has to do with godaddy, i'm on vultr with namescheap. – user3108268 Feb 20 '17 at 9:34
  • also does not redirect from https://example.com to https://www.example.com – user3108268 Feb 20 '17 at 9:42
  • If user want to enforce all non www to www only then best is to use godaddy redirection. From you godaddy dns manager can permanently redirect to https and www no need to add in nginx. – Ashish Gupta Feb 20 '17 at 9:47
  • In my new code block location match will be present in both 80 and 443 – Ashish Gupta Feb 20 '17 at 10:00
  • One does not want to use if in cases like this when it can be easily avoided. – Tero Kilkanen Feb 20 '17 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.