Nginx config generator for Ubuntu

Profile changes only select the applicable rules; they do not install software or reset other values.

Every hostname in this bundle must be unique. DNS and certificates must already cover the names you serve.

Alternative ports must be allowed by the firewall and included in the URL. Avoid sharing a port between HTTP and HTTPS.

DNS AAAA records, routing and firewall rules also need to work. This does not create IPv6 connectivity.

Coordinate PHP post_max_size and upload_max_filesize. A larger request limit does not change file-type validation.

A generated map handles upgrade and ordinary connections separately. This does not configure the upstream application.

The upstream certificate must match its hostname. Verification is enabled rather than accepting an untrusted certificate.

Cloudflare Full (strict) also needs a valid origin certificate. No certificate is issued by this page.

HTTP/3 uses the same port over UDP when enabled.

The request path and query string remain intact. ACME validation retains its dedicated HTTP route.

Both are permanent redirects for Google; avoid redirect loops between Nginx, WordPress and a CDN.

Requires --with-http_v2_module and TLS ALPN support. Uses syntax matching the selected Ubuntu Nginx family, retaining HTTP/1.1 fallback.

More streams also consume resources. Tune using observed concurrency and client behavior rather than increasing the limit automatically.

Requires --with-http_v3_module, TLS 1.3 and reachable UDP on the chosen HTTPS port. The module remains experimental. TCP HTTPS stays available; 0-RTT stays off.

After successful testing you can increase this. When removing HTTP/3, allow the previous advertisement to expire or clear it through a deliberate header rollout.

Retry adds an address-validation step. It does not replace rate controls, firewall rules or denial-of-service protection.

Requires a compatible kernel and network setup with UDP_SEGMENT. This is a host capability, not an automatic speed improvement.

With no file, tokens use a new random key after a reload. A persistent file must be created securely outside the web root and readable by Nginx; enter only its path.

The directory must contain .well-known/acme-challenge tokens. This neither installs an ACME client nor creates a certificate.

The resulting token path is WEBROOT/.well-known/acme-challenge/TOKEN.

HSTS is persistent in browsers; it is not needed just to redirect HTTP.

A long max-age extends the impact of a certificate or HTTPS outage.

This includes hosts that are not listed in this generator.

Requires includeSubDomains and max-age of at least one year here. The token does not submit your domain to a browser list.

It is not a PHP execution-time setting or an overall request-duration limit.

Enter a relative path without a hostname or parent-directory segments.

Nginx does not create sitemap content, canonical tags or structured data. Static robots and sitemap files take priority if present.

For staging, pair indexing controls with authentication. Noindex does not make a site private and should not be used as a canonicalization fix.

Queries and non-GET/HEAD PHP requests also receive no-store. Application cookies are preserved; public static assets are handled separately.

Direct URLs receive 404, while authorized internal delivery can serve files. Redirect-only download delivery is incompatible with this protection.

Ordinary media-library uploads are public. A custom downloads directory needs a matching rule.

The .well-known namespace remains available for legitimate validation; hidden descendants and PHP-like files there are still blocked.

Rules intentionally do not ban all ZIP, CSV, PDF, JSON or XML files: plugins and downloadable products may need those.

These file types are blocked even if they exist. Custom applications needing them must use a different profile or disable this rule.

Do not use this option on a hostname intentionally serving those tools.

The rule runs before static and PHP locations. Legitimate media files still work.

Blocking can affect remote publishing and integrations such as Jetpack. This is an endpoint rule, not a user-agent bot filter.

Turning this off reduces log writes; it does not stop requests arriving at the network.

SAMEORIGIN prevents other origins embedding this site. Header snippets are re-included where child headers would replace inheritance.

It can block checkout callbacks and crawlers. ACME token validation is exempt; no passwords are entered here.

Create and manage credentials on your server.

The generated limit returns 429 and does not affect REST, wc-ajax or payment webhooks.

Shared IPs may represent multiple people. The burst absorbs short sequences of requests.

Nodelay serves the permitted burst immediately; requests beyond it receive 429.

The bundled IP snapshot was checked on 15 October 2026. Review it for changes. Restrict direct origin access at the firewall separately.

HTML, XML, JSON, product-download archives and private WooCommerce files are excluded from this generic asset rule. Missing assets return 404.

No blanket immutable flag is added; overwritten URLs can otherwise remain stale for too long.

Queries, authentication, private routes and session cookies always bypass. Set-Cookie and upstream cache restrictions are respected. There is no automatic WordPress purge integration.

Upstream cache headers can govern freshness. No checkout response should be cached merely because a TTL is configured.

Each site has its own cache directory and shared-memory zone. The worker needs write access.

Already-compressed image and archive types are excluded. Compression level is fixed at a moderate 5.

Brotli is a third-party Nginx module. These controls generate configuration; they do not install module binaries or create compressed assets.

The broader scope can compress authenticated HTML too. Review compression side channels and CDN ownership for sensitive responses. Gzip remains a separate setting.

On-demand compression uses worker CPU. Already encoded responses pass through; keep gzip available for clients that do not request Brotli.

Higher values trade CPU time for potentially smaller output. Precompressed files have their own build-time quality; this setting does not recompress them.

The threshold relies on Content-Length. It does not promise a minimum size for streamed responses whose final length is unknown.

Requires ngx_http_brotli_static_module. The original file remains required by this recipe; deploy both together. Uses on, never always. Reverse-proxied files are handled by their upstream instead.

Typical filename: ngx_http_brotli_filter_module.so. Use a package/build matching the Nginx binary and avoid duplicate loaders. An empty path does not mean the module is installed.

Typical filename: ngx_http_brotli_static_module.so. A filter module alone cannot implement brotli_static, and a static module alone cannot compress responses on demand.

Official releases checked on 15 October 2026: stable 1.30.6 and mainline 1.31.7. This page does not auto-update that snapshot.

This is a Linux configuration bundle. File, socket and cache permissions must match this account.

More Nginx workers do not increase the size of a PHP-FPM pool.

Upstream connections also count; this is not a guarantee of the same number of PHP requests.

A different PID path can prevent existing service-management commands from finding Nginx.

Some unusual network or virtual filesystems need different behavior.

This controls idle connections, not PHP execution or checkout transaction time.

Legacy TLS 1.0/1.1, HTTP/2 push and deprecated XSS headers are deliberately omitted. OCSP stapling is not enabled automatically.

Create it with suitable ownership before testing the generated configuration.

Disabling access logs also removes visibility into probes, crawlers and cache behavior.

Combined logs are buffered for up to one second to reduce small writes.

Parent directories and permissions must already exist.

Debug logging requires a debug-enabled build and can be very verbose.