Nginx: Redirect IP Access to Your Domain Automatically

2026: do not redirect arbitrary IP/Host requests to the production domain

An HTTPS request to a direct IP can fail during the TLS handshake because no matching certificate is available, so a port-443 default-server redirect cannot guarantee that a visitor will see the redirect. A safer default server normally rejects unknown Host headers (for example 444/400) instead of reflecting an arbitrary Host or IP into the production site.

Set explicit HTTP-to-HTTPS and www/non-www canonical redirects only for accepted domain names. Test first with sudo nginx -t, then sudo systemctl reload nginx. Verify known HTTP/HTTPS hostnames, valid and invalid Host headers, and direct-IP requests; check the final canonical, HSTS, and certificate behavior.

References: NGINX request processing.