Redirect www to non-www, or non-www to www, with Nginx

Give the hostname you want to retire a redirect to a fixed canonical hostname. Keep $request_uri so an inner page stays an inner page. Either hostname can work; consistency across redirects, links, and canonical URLs matters more than the presence of www.

Redirect www to the apex domain

This example covers both HTTP names and the noncanonical HTTPS name:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate     /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    root /var/www/site;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

The last block is a static-site example; keep your application's actual content or proxy handler there. The certificate shown must cover both names. Alternatively, each HTTPS server can use its own certificate covering the name it serves.

Redirect the apex domain to www

Reverse the roles: set the HTTP block's target to https://www.example.com$request_uri, make the HTTPS redirect block's server_name be example.com, and serve content in the HTTPS www.example.com block. Do not configure both directions simultaneously.

TLS negotiation happens before an HTTPS redirect can be delivered, so the hostname being redirected needs a valid certificate too. A certificate for *.example.com alone does not cover example.com; request the apex explicitly when needed.

Validate all four entry points

curl -I 'http://example.com/docs?a=1'
curl -I 'http://www.example.com/docs?a=1'
curl -I 'https://example.com/docs?a=1'
curl -I 'https://www.example.com/docs?a=1'

Inspect Location, status, and the final content. Test temporarily with 302 before committing to a cacheable permanent redirect; use 307/308 when clients must preserve the method. Guance HTTP synthetic tests can check the first hop separately from a test that follows redirects to the final page.

Keep canonical signals consistent

Use the selected HTTPS hostname in internal links, sitemaps, and page canonical URLs. Search engines can consolidate duplicate URLs, but conflicting signals make the preferred URL less clear. Do not rely on an obsolete Search Console preferred-domain setting.

A www hostname may offer useful DNS-delegation choices. Cookie scope depends on the cookie's Domain attribute; choosing www does not automatically isolate cookies.

FAQ

Can I use rewrite instead of return?

Yes, but a fixed-host redirect needs no regex rewrite. return states the intended response directly.

Why is there a redirect loop?

Check whether the canonical HTTPS block redirects to itself, whether another layer redirects in the opposite direction, and whether a TLS-terminating CDN connects to an origin that always redirects HTTP. Align the origin protocol and trusted forwarded-protocol handling with the deployment.

What should I check behind a CDN?

Confirm the origin Host header, TLS mode, and cached redirect responses. Clear or expire stale responses after changing rules. Test the public path as well as the origin so both agree on the canonical URL.

References: Nginx request routing, Google canonical URL guidance.