Iinstallation and configuration guides for Apache, Nginx, IIS, HAProxy, Caddy, and other web servers.
Most SSL guides focus on Nginx and Apache. But if you’re running HAProxy for load balancing, Caddy for automatic HTTPS, or Lighttpd on an embedded system, the configuration is different enough to warrant its own guide. I’ve set up SSL on all of these and the differences matter. HAProxy: SSL Termination at the Load Balancer […]
SSL Certificates for HAProxy, Caddy, and Other Web Servers Read Post »
A 403 Forbidden response means the server understood the request but is refusing to allow it. That sounds straightforward, but the cause can sit in three very different layers: the web server configuration, the Linux filesystem permissions, or the application itself. That layered view matters because 403 is one of the easiest errors to “fix”
HTTP 403 Forbidden in Nginx and Apache: The Permission Checks I Actually Use Read Post »
An HTTP 500 Internal Server Error is deliberately vague. That is not a bug in the protocol. It is the server telling the client, “something went wrong on my side, but I am not going to explain it here.” From a security perspective, that is reasonable. From an operations perspective, it means the browser page
HTTP 500 Internal Server Error: How I Debug It Step by Step in Production Read Post »
Apache VirtualHosts are one of those features that feel simple until you inherit a server with twelve site files, three half-finished redirects, one missing ServerName, and an SSL vhost that is somehow answering for the wrong domain. I have spent enough time on those systems that I no longer trust “it should match the right
Apache VirtualHost Configuration Guide: How I Keep Multi-Site Apache Setups Predictable Read Post »
.htaccess is one of those Apache features that refuses to die because it solves a real problem, especially on shared hosting and delegated environments. At the same time, it is responsible for a lot of messy rewrite rules, unnecessary per-request filesystem checks, and 500 errors caused by one bad line buried in a content directory.
Nginx handles SSL differently from Apache. There’s no module system to enable — it’s built in. But the configuration has some nuances that trip people up, especially around cipher suites, OCSP stapling, and HTTP/2. I’ve set up SSL on Nginx across dozens of servers, and this guide reflects what actually works in production, not just
Setting Up SSL in Nginx: A Complete Configuration Guide Read Post »