How to Cleanly Force HTTPS and WWW (or Non-WWW) Canonical Redirects in Nginx

Implementing clean 301 canonical redirects in Nginx prevents duplicate content penalties in search engines and ensures all incoming traffic is encrypted over HTTPS. Instead of convoluted rewrite regex rules, modular Nginx server blocks handle HTTP-to-HTTPS and subdomain canonicalization with maximum performance.

Canonical Best Practice: Always redirect in a single 301 hop to prevent redirect chains.

Scenario A: Force HTTPS with Non-WWW (example.com)

Create /etc/nginx/conf.d/force_ssl_non_www.conf:

# Redirect HTTP and WWW directly to canonical HTTPS non-WWW
server {
    listen 80;
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://example.com$request_uri;
}

server {
    listen 80;
    server_name example.com;
    return 301 https://example.com$request_uri;
}

Scenario B: Force HTTPS with WWW (www.example.com)

Create /etc/nginx/conf.d/force_ssl_www.conf:

server {
    listen 80;
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}