Àlex
Àlex

Reputation: 704

My website keeps redirecting even all https is disabled in Cloudflare and NGINX

I'm having several problems with my Cloudflare + NGINX configuration together. There are some websites that work for me and others that don't work, with the same configuration in the server and in Cloudflare. So the main problem I have is with the domains that don't work is that they keep redirecting to HTTPS when it is not configured either in Cloudflare or NGINX. So the question is how can I fix automatically redirecting HTTPS as I want to use HTTP for now. Maybe there are some people with this same problem in the community. Thanks!

Here there are some captures about my not working domain raventechnology.es IP address hidden for privacy and attacks.

DNS Cloudflare Configuration

SSL Cloudflare Turned Off

Disabled Cloudflare HTTPS Rewrites

The Nginx configuration file for the site:

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as a reference inside of sites-available where it will continue to be
# updated by the Nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or WordPress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80;
    listen [::]:80;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self-signed certs generated by the SSL-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html/raventechnology;

    # Add index.php to the list if you are using PHP
    index index.php index.html;

    server_name raventechnology.es www.raventechnology.es;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ /index.php?$args;
    }

    # pass PHP scripts to FastCGI server
    #
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
    
        # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/run/php/php8.0-fpm.sock;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with Nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}
}

Upvotes: 0

Views: 568

Answers (1)

Paolo Tagliaferri
Paolo Tagliaferri

Reputation: 1021

For the domain above, it looks like at some point HSTS was enabled. This means that your site was pre-loaded in a browser list, telling the browser that it must be loaded over HTTPS. This means that the site must be served over HTTPS until after the expiration time of the HSTS policy.

https://hstspreload.org/?domain=raventechnology.es

enter image description here

Upvotes: 1

Related Questions