How to Force HTTPS Redirects in Nginx

The nginx HTTPS redirect config

Replace the content-serving port-80 server block with a minimal redirect block:

server {
    listen 80;
    server_name _;

    return 301 https://$host$request_uri;
}

That is the entire block. Nothing else belongs in a redirect-only server block - no root, no location, no try_files. Keeping it minimal avoids accidentally serving any content over HTTP before the redirect fires.

Why $host$request_uri and not a hardcoded domain

• $host preserves the hostname from the incoming request, so http://example.com/page redirects to https://example.com/page and http://www.example.com/page redirects to https://www.example.com/page - no hard-coding needed, works for every virtual host.
• $request_uri carries the full path plus query string (/page?id=5), so users land on the exact URL they requested rather than the root.

Apply the change safely

Always validate before reloading - a config error would drop traffic:

nginx -t               # check syntax
nginx -s reload        # graceful reload (keeps existing connections alive)

Then confirm the redirect is live:

curl -I http://localhost/
# HTTP/1.1 301 Moved Permanently
# Location: https://localhost/

A 301 (Permanent) in the response tells browsers to cache the redirect, so subsequent visits go straight to HTTPS without hitting port 80 at all.

Add HSTS for belt-and-braces protection

A 301 redirect stops most passive eavesdropping, but the very first request still travels over HTTP. HTTP Strict Transport Security (HSTS) tells the browser never to attempt HTTP again for your domain:

server {
    listen 443 ssl;
    server_name example.com;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    # ... rest of TLS config
}

Set max-age to at least one year (31536000 seconds). Only add preload once you are confident the site will stay HTTPS-only - it is very hard to undo.

Production edge note

Many production stacks terminate TLS at a CDN or load balancer (Cloudflare, AWS ALB), so the application server never sees raw HTTPS. The redirect logic moves to the edge config (Cloudflare Page Rules, ALB listener rules), but the principle - bounce port 80 to 443 before serving anything - is identical. Nginx's return 301 pattern is the right mental model wherever you configure it.