SysAdmin Tools

Nginx Config Generator

Build a complete Nginx server block for static sites, PHP, reverse proxies, and Node.js apps — with SSL, gzip, security headers, caching, and rate limiting.

nginx.conf preview
# ─────────────────────────────────────────────────────────────
# Nginx configuration — generated by SysAdmin Tools
# Server type: Static Site (HTML/CSS/JS)
# Place this file in /etc/nginx/sites-available/ and symlink it
# into /etc/nginx/sites-enabled/, then run: nginx -t && systemctl reload nginx
# ─────────────────────────────────────────────────────────────

# ── Main server block ──
server {
    listen 80;
    listen [::]:80;

    server_name example.com;
    root /var/www/html;
    index index.html index.php;

    # ── Serve static files ──
    location / {
        try_files $uri $uri/ =404;
    }
}

Advertisement

An nginx config generator lets you build a complete, syntactically correct nginx server block visually — without memorising directive names or hunting through documentation. Toggle the features you need on the left, and a ready-to-deploy nginx.conf is written in real time on the right, complete with explanatory comments.

Nginx configuration is powerful but unforgiving: a misplaced semicolon, a wrong location matching order, or a forgotten proxy_set_header can break routing or silently disable WebSockets. This nginx configuration generator online handles the boilerplate for four common scenarios — a static site, a PHP application over FastCGI, a reverse proxy, and a Next.js/Node.js app — and layers optional SSL, gzip, security headers, HSTS, browser caching, rate limiting, custom error pages, and logging on top.

Whether you are standing up a new nginx virtual host, adding nginx SSL config from Let's Encrypt, or wiring up a nginx reverse proxy config generator for a Node.js backend, the tool produces the exact server { } block you need. It runs entirely in your browser — no data is sent anywhere — so you can copy the config or download it as nginx.conf and drop it straight into /etc/nginx/sites-available/.

Every generated block follows current best practice: TLS 1.2 and 1.3 only, an SSL session cache, sensible proxy_pass headers including the Upgrade/Connection pair for WebSockets, and a limit_req_zone placed correctly for nginx rate limiting. Use it as a starting point, then tweak paths to match your server.

How to Use the Nginx Config Generator

  1. 1

    Choose your server type

    Pick Static Site, PHP Application, Reverse Proxy, or Next.js/Node.js App. This selects the base template — the correct location blocks, try_files or proxy_pass directives are generated automatically for that scenario.

  2. 2

    Set the basic details

    Enter your server name (domain), optionally add the www variant, and set the root directory and index files. These populate the server_name, root, and index directives in the block.

  3. 3

    Enable SSL and security options

    Turn on SSL to add certificate paths, TLS 1.2/1.3, and session caching, and optionally force an HTTP→HTTPS redirect. Add HSTS, security headers, gzip compression, and browser caching with a single toggle each.

  4. 4

    Add proxy, PHP, rate limiting or logging

    Depending on your server type, set the upstream URL for a reverse proxy or the PHP-FPM socket for FastCGI. Optionally enable rate limiting, custom error pages, and access/error logging with their own paths.

  5. 5

    Copy or download nginx.conf

    The live preview updates as you toggle options. Click "Copy Config" to grab the text, or "Download nginx.conf" to save the file. Place it in /etc/nginx/sites-available/, symlink it into sites-enabled/, then run nginx -t and reload.

Understanding the Generated Nginx Config

Nginx processes requests through a hierarchy of contexts. The http {} context holds global directives; inside it, each server block (server { }) is a virtual host matched by listen port and server_name. Within a server block, location blocks (location { }) match request URIs and decide how each is served — from disk with try_files, passed to PHP-FPM with fastcgi_pass, or forwarded to a backend with proxy_pass. When SSL is enabled the generator emits a block listening on 443 ssl with http2 on, restricts protocols to TLS 1.2 and 1.3, and adds an ssl_session_cache for performance. If you also force HTTPS, a second small server block on port 80 issues a 301 redirect to the secure version. A few directives — most notably limit_req_zone for rate limiting — must live in the http {} context, so the generator places them above the server block with a comment reminding you where they belong. For reverse proxies, the proxy_pass directive is accompanied by the standard header set (Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto) plus proxy_http_version 1.1 and the Upgrade/Connection headers that allow WebSocket connections to pass through — a common thing to forget when proxying Node.js apps.
FieldDescription
server { }A virtual host. Matched by the listen port and server_name; contains all directives for one site.
listenThe port (and protocol) the block accepts connections on — 80 for HTTP, 443 ssl for HTTPS.
server_nameThe domain(s) this block answers for, e.g. example.com www.example.com.
locationMatches request URIs and defines how they are served — static files, FastCGI, or proxied upstream.
proxy_passForwards matching requests to an upstream address such as http://127.0.0.1:3000 for a Node.js app.
fastcgi_passPasses PHP requests to a PHP-FPM socket or TCP address for processing.
ssl_certificatePath to the fullchain certificate (and ssl_certificate_key to the private key), typically from Let's Encrypt.
limit_req_zoneDefines a shared memory zone for rate limiting. Must be declared in the http {} context, not inside a server block.

Advertisement

Common Nginx Config Use Cases

Reverse proxy for a Node.js app

Put Nginx in front of a Node.js or Next.js process listening on localhost:3000. The generated proxy_pass block forwards traffic, sets the correct headers, and enables WebSocket upgrades — the standard production setup for Node apps.

Serve a PHP site with FastCGI

Generate a PHP-FPM configuration with the correct fastcgi_pass socket, a front-controller try_files rule, and a location block that denies access to hidden files like .env — ideal for Laravel, WordPress, or a custom PHP app.

Add Let's Encrypt SSL to a site

Enable SSL to produce a 443 server block with TLS 1.2/1.3, session caching, and optional HSTS, plus a port-80 block that redirects HTTP to HTTPS. Point the certificate paths at your Let's Encrypt fullchain and privkey files.

Harden and speed up a static site

For a static HTML/CSS/JS site, add gzip compression, long-lived browser caching for images, fonts, and assets, and a full set of security headers — turning a bare server block into a production-ready configuration.

Nginx Config Generator — Frequently Asked Questions

What is an Nginx server block?
An Nginx server block is the configuration unit that defines a virtual host — a single website or application served by Nginx. It is written as a server { } block and is matched to incoming requests by its listen port and server_name directive. Inside it you define the document root, index files, SSL settings, and one or more location blocks that control how different URIs are handled. It is the Nginx equivalent of an Apache VirtualHost.
How do I configure Nginx as a reverse proxy?
Use a location block with the proxy_pass directive pointing at your backend, for example proxy_pass http://127.0.0.1:3000;. Alongside it you should set proxy_http_version 1.1 and forward the standard headers — Host, X-Real-IP, X-Forwarded-For, and X-Forwarded-Proto — so the backend sees the real client details. To support WebSockets, add proxy_set_header Upgrade $http_upgrade; and proxy_set_header Connection "upgrade";. This generator produces all of that automatically when you choose the Reverse Proxy or Node.js server type.
What is the difference between Nginx and Apache .htaccess?
Apache reads per-directory .htaccess files at request time, so you can drop rules into any folder without restarting the server. Nginx has no .htaccess equivalent — all configuration lives in central server block files (usually in /etc/nginx/sites-available/) and is loaded once when Nginx starts or reloads. This makes Nginx faster (no per-request file lookups) but means changes require an nginx -t test and a reload. Rewrite rules, redirects, caching, and access control that you would write in .htaccess are instead written as directives inside Nginx location and server blocks.
How to add SSL to Nginx server block?
In the server block, set listen 443 ssl; (and optionally http2 on;), then add ssl_certificate pointing at your fullchain.pem and ssl_certificate_key pointing at your privkey.pem — for Let's Encrypt these live under /etc/letsencrypt/live/yourdomain/. Restrict protocols with ssl_protocols TLSv1.2 TLSv1.3; and add an ssl_session_cache for performance. To force HTTPS, add a second server block on port 80 that returns 301 https://$host$request_uri;. Enable the SSL toggle in this tool to generate all of it.
How to configure Nginx for a Node.js application?
Run your Node.js (or Next.js) app on a local port such as 3000, then use Nginx as a reverse proxy in front of it. Create a server block with a location / that uses proxy_pass http://127.0.0.1:3000; along with proxy_http_version 1.1, the Upgrade and Connection headers for WebSockets, and the X-Forwarded-* headers. Add SSL on port 443 for HTTPS. Select the "Next.js / Node.js App" server type in this generator to produce a correct configuration instantly.
What is proxy_pass in Nginx?
proxy_pass is the directive that tells Nginx to forward a request to another server (the upstream) instead of serving it from disk. For example, proxy_pass http://127.0.0.1:3000; sends the request to a local application on port 3000. Nginx returns the upstream response to the client, acting as a reverse proxy. It is almost always combined with proxy_set_header directives so the backend receives the original host and client IP rather than Nginx's own.
How to enable gzip compression in Nginx?
Add gzip on; to the server or http context, then tune it with gzip_vary on;, gzip_min_length 1024; (skip tiny responses), and gzip_types listing the MIME types to compress — typically text/plain, text/css, application/javascript, application/json, image/svg+xml, and the font types. Compression reduces text-based transfer sizes by 60–80%, improving load times and Core Web Vitals. Toggle the Gzip Compression option in this tool to add a complete, tuned gzip block.
How to set up rate limiting in Nginx?
Rate limiting takes two directives. First, in the http {} context, declare a shared memory zone: limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s; which tracks requests per client IP. Then, inside the server or location block you want to protect, apply it with limit_req zone=req_limit burst=20 nodelay;. The burst allows short spikes while the rate caps the sustained request rate. This generator places the zone in the correct context and applies limit_req in your main location automatically.
What are the security headers I should add to Nginx?
The core set is: X-Frame-Options "DENY" to prevent clickjacking, X-Content-Type-Options "nosniff" to stop MIME sniffing, Referrer-Policy "strict-origin-when-cross-origin" to limit referrer leakage, and, on HTTPS sites, Strict-Transport-Security (HSTS) to enforce secure connections. X-XSS-Protection "1; mode=block" is sometimes included for older browsers. Each is added with an add_header directive and the always flag so it applies to error responses too. Enable the Security Headers and HSTS toggles to add them.
How to redirect HTTP to HTTPS in Nginx?
Create a dedicated server block that listens on port 80 and returns a permanent redirect: server { listen 80; server_name example.com www.example.com; return 301 https://$host$request_uri; }. Your main HTTPS server block then listens on 443 ssl. Using return 301 is faster and cleaner than a rewrite rule. Enable both the SSL and "Force HTTP → HTTPS redirect" toggles in this generator to produce the redirect block alongside your secure server block.

Related Tools

.htaccess Generator

Generate the Apache equivalent if your host runs Apache instead of Nginx.

SSL Checker

Verify your certificate chain and expiry after adding SSL to your server block.

Security Headers

Audit the HTTP security headers your Nginx config sends once it is live.