Nginx Config Generator
Build an nginx server block for PHP, WordPress, Laravel, SPAs or a proxy.
Build a complete nginx server block. Choose your application type — PHP, WordPress, Laravel, a static site, a single-page app or a reverse proxy — and get a config with sensible SSL, caching, compression and security defaults.
The PHP configurations include the try_files guard that prevents
the most serious nginx misconfiguration there is, which many published examples
still omit.
How it works
An nginx server block defines how one site is served: which names it answers to, where its files live, and how each kind of request is handled. Unlike Apache, nginx reads no per-directory file — all configuration is in the server config, and changes need a reload.
Location matching is not top-to-bottom. nginx picks the single
most specific matching location and uses only that. Exact matches
(location = /path) win first, then prefix matches, then regular
expressions in the order written. This trips up people coming from Apache, where
rules are evaluated in sequence and accumulate.
The PHP-FPM trap. A naive config passes anything ending
.php to PHP-FPM. If your site accepts uploads, an attacker uploads
evil.jpg containing PHP, requests
/uploads/evil.jpg/x.php, and with cgi.fix_pathinfo
enabled PHP happily executes the JPEG. The fix is
try_files $uri =404; inside the PHP location — it refuses to hand
anything to PHP-FPM unless that exact file exists. Every PHP config here includes
it.
Other things worth knowing:
- Static files. Let nginx serve them directly. Routing images and CSS through a PHP front controller wastes an interpreter process per request.
- SPA fallback. A single-page app needs
try_files $uri $uri/ /index.htmlso client-side routes return the app rather than a 404 on refresh. - Proxy headers. When proxying, forward
X-Forwarded-ProtoandX-Forwarded-For— without them the application sees every request as HTTP from the proxy's own address, which breaks HTTPS detection and rate limiting alike.
Always run nginx -t before reloading. It validates the whole
configuration, and unlike Apache a bad config simply refuses to load rather than
taking the site down mid-serve.
Frequently asked questions
Why do I need try_files in the PHP location?
Without it, nginx passes any URL ending in .php to PHP-FPM even when no such file exists. Combined with uploads and cgi.fix_pathinfo, an attacker can get a disguised PHP file executed. "try_files $uri =404;" refuses anything that is not a real file, closing the hole.
Why is my location block being ignored?
nginx uses the single most specific match, not the first. An exact match beats a prefix, which beats a regex. If a broader block is winning, make yours more specific or use the ^~ modifier to stop regex evaluation.
Where does this file go?
Usually /etc/nginx/sites-available/yourdomain.conf, symlinked into sites-enabled. On some distributions it is /etc/nginx/conf.d/yourdomain.conf. Run nginx -t to validate, then systemctl reload nginx.
Does nginx read .htaccess files?
No, and it never will — it is a deliberate design decision. Reading a per-directory file on every request costs performance, so all configuration lives in the server config and is loaded once.
Why does my single-page app 404 on refresh?
The browser requests /some/route directly and nginx looks for a file there. You need try_files $uri $uri/ /index.html so unmatched paths return the app, which then handles routing client-side.
Should I enable HTTP/2?
Yes, on HTTPS. It multiplexes requests over one connection and removes most of the benefit of old tricks like domain sharding and sprite sheets. The config here enables it on the TLS listener.
Related tools
.htaccess Generator
Build an .htaccess file for redirects, HTTPS, caching and security.
Server Config.htaccess to Nginx Converter
Convert common Apache .htaccess rewrite rules into Nginx configuration syntax.
Server Config301 Redirect Generator
Generate exact 301 redirect code for Apache, Nginx, and PHP.
Server ConfigSecurity Headers Checker
Grade any site's HTTP security headers and see exactly what to add.
SecurityCron Expression Parser
Translate a cron expression into plain English and see its next run times.
Server ConfigMySQL Configuration Tuner
Generate an optimized MySQL/MariaDB my.cnf file based on your server RAM.
Server ConfigNeed hosting that just works?
Free SSL, daily backups and 24×7 support on every Loudhost plan.