How to use the Nginx Config Generator
- Pick the scenario: Static site, SPA (all routes fall back to
index.html), Reverse proxy to an app on a port, or PHP-FPM. - Enter your domain, the document root or upstream address and choose how
wwwshould be handled. - Tick the extras — HTTPS with Let’s Encrypt paths, gzip, static caching, security headers, WebSockets, rate limiting.
- Copy the config, test it with
nginx -tand reload Nginx.
What each option adds
| Option | Directives |
|---|---|
| HTTPS | Port 80 server that redirects with 301, listen 443 ssl, Certbot certificate paths and the ACME challenge location |
| SPA | try_files $uri $uri/ /index.html; so client-side routes don’t return 404 |
| Reverse proxy | proxy_pass plus Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto headers |
| WebSockets | proxy_http_version 1.1 with Upgrade / Connection headers |
| gzip | Compression for text, JSON, JS, CSS, SVG and fonts |
| Static caching | One-year Cache-Control: immutable for hashed assets, short cache for HTML |
| Security headers | X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy |
| Rate limit | limit_req_zone (in the http context) and limit_req with a burst |
Getting the certificate
Create the config with HTTPS off first, reload Nginx and run sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com — or simply sudo certbot --nginx. Then switch HTTPS on, reload, and check the result with the SSL Checker, Redirect Checker and Security Headers Checker.
Common mistakes
- Missing semicolon — every directive ends with
;.nginx -tshows the exact line. - add_header inheritance — an
add_headerinside alocationreplaces all headers from the server level. The generator repeats security headers where needed. - Trailing slash in proxy_pass —
proxy_pass http://app/;strips the location prefix,proxy_pass http://app;keeps it. - Wrong MIME types — fonts or
.webmanifestserved asapplication/octet-stream; look them up with the MIME Type Lookup.
Running in Docker? Combine it with the Docker Compose Generator.
Tools that pair well with the Nginx Config Generator
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- .gitignore Generator — Tick your stack — Node, Python, React, Next.js, Docker, macOS, VS Code and 40 more — and get one clean, de-duplicated .gitignore with commented sections, ready to download.
- Git Command Generator — Pick a task like “undo the last commit but keep my changes” or “rename a branch on GitHub”, fill in your branch names and get the exact Git commands — each line explained, risky steps flagged.
- package.json Generator — Fill in a form and get a valid package.json — npm name validation, script presets for Vite, Next.js, Node and TypeScript libraries, exports, engines, license and repository — with warnings for common mistakes.
Frequently asked questions
How do I test an Nginx config before reloading?
Run sudo nginx -t. It checks syntax and file paths and prints the line of any error. Only reload (sudo systemctl reload nginx) when it says “syntax is ok” and “test is successful”.
How do I make a React or Vue app work on page refresh?
Use the SPA scenario. It adds try_files $uri $uri/ /index.html; so every unknown path is answered with index.html and the client-side router takes over.
Where does limit_req_zone go?
limit_req_zone must be in the http context (for example in /etc/nginx/nginx.conf or at the top of a file included there), not inside server. The generator puts it at the top of the file with a comment; sites-enabled files are included in http by default.
Should I enable HSTS?
Only when HTTPS works on the domain and all subdomains you include. Browsers remember HSTS for the max-age period, so a broken certificate then makes the site unreachable. Start with a short max-age.