NGINX and Apache config snippets

Send every plain-HTTP request to HTTPS with a permanent (301) redirect. Replace example.com with your domain.

NGINX, in the site's config:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Apache, in .htaccess (mod_rewrite enabled):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Pick one address for your site, so search engines do not see two copies of every page.

NGINX:

server {
    listen 443 ssl;
    server_name www.example.com;
    # ssl_certificate and ssl_certificate_key lines here
    return 301 https://example.com$request_uri;
}

Apache, in .htaccess:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

Compressing text responses makes pages smaller and faster to load.

NGINX, in the http or server block:

gzip on;
gzip_min_length 1024;
gzip_types text/css application/javascript application/json image/svg+xml;

Apache, in .htaccess (mod_deflate enabled):

AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml

Tell browsers to keep images, CSS and scripts, so repeat visits load faster.

NGINX, in the server block:

location ~* \.(css|js|png|jpg|jpeg|gif|svg|webp|woff2)$ {
    expires 30d;
    add_header Cache-Control "public";
}

Apache, in .htaccess (mod_expires enabled):

ExpiresActive On
ExpiresByType text/css "access plus 30 days"
ExpiresByType application/javascript "access plus 30 days"
ExpiresByType image/webp "access plus 30 days"

These headers stop common browser attacks, such as clickjacking and content sniffing.

NGINX, in the server block:

add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache, in .htaccess (mod_headers enabled):

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Check the syntax before you reload, so a typo does not take the site down. On a server you manage:

sudo nginx -t
sudo systemctl reload nginx

sudo apachectl configtest
sudo systemctl reload apache2

On Debian and Ubuntu the Apache service is apache2; on other systems it is often httpd. A .htaccess change applies on the next request, with no reload.