How to Redirect HTTP to HTTPS in Nginx Proxy Manager

In Nginx Proxy Manager, you redirect HTTP to HTTPS per proxy host. First you attach an SSL certificate to the host. Then you turn on the Force SSL option on that host's SSL tab. After that, anyone who opens the plain HTTP version of the site is sent to the HTTPS version automatically. You don't need any custom Nginx configuration for this.

This guide covers the steps, a few points that commonly cause confusion, and how to check the result. It also explains why the redirect matters if you host a video-call, webcam or other browser tool that needs the camera or microphone.

First, make sure you're changing the right thing

Three different things can be called an "HTTPS redirect" in Nginx Proxy Manager. Each one is set up differently:

• Redirecting visitors of a site you proxy from HTTP to HTTPS. This is the common case, and the Force SSL option on the proxy host handles it.
• Sending one domain name to a different one. The separate Redirection Hosts section is for this. It is not needed for a plain HTTP-to-HTTPS switch on the same name.
• Securing the Nginx Proxy Manager admin panel itself. By default the panel is served over plain HTTP on its own port. To reach it over HTTPS, people usually create a proxy host that points to the panel and enable a certificate and Force SSL on that host, just like any other site.

What needs to be in place before you start

• A working proxy host. The site should already load over plain HTTP through Nginx Proxy Manager.
• A domain name that points to the public address of the machine running Nginx Proxy Manager.
• Ports 80 and 443 reaching Nginx Proxy Manager, usually through port forwarding on your router or firewall rules on your server. Port 80 must stay open even after you force HTTPS. The redirect is served on it, and Let's Encrypt usually checks it when it issues or renews certificates.

Step-by-step: forcing HTTPS on a proxy host

• 1. Sign in to the Nginx Proxy Manager admin panel and open Hosts, then Proxy Hosts.
• 2. Find the host you want to secure, open its menu and choose Edit.
• 3. Switch to the SSL tab.
• 4. Under SSL Certificate, choose an existing certificate for this domain, or choose the option to request a new certificate from Let's Encrypt.
• 5. If you request a new one, enter an email address for certificate notices and agree to the Let's Encrypt terms when prompted.
• 6. Turn on Force SSL. This is the switch that creates the HTTP-to-HTTPS redirect.
• 7. Optionally, turn on HTTP/2 Support. It is unrelated to the redirect but is commonly enabled at the same time.
• 8. Leave HSTS off for now (see the caution below), then click Save.
• 9. Wait for the certificate request to finish. If it fails, the host is not saved with HTTPS, and the redirect will not work.

Option names and layout can differ slightly between Nginx Proxy Manager versions. The material supplied for this article did not identify a specific version. If a label doesn't match exactly, look for the certificate selector and the Force SSL switch on the host's SSL settings.

How to confirm the redirect works

• Open a private or incognito browser window, so cached redirects and old sessions don't skew the result.
• Type the site's address starting with plain http and press Enter. The address bar should switch to https by itself, and the browser should show the secure-connection indicator without a certificate warning.
• For a command-line check, run curl with the -I option against the http version of the address. The response should be a redirect status in the 300 range with a Location header pointing to the https version.
• Then load the https version directly and confirm the page itself works, not just the redirect.

If something goes wrong

Symptom | Likely cause | What to check

Certificate request fails | Port 80 not reachable from the internet, or the domain doesn't point to this server yet | Port forwarding for 80 and 443, the domain's address record, and any firewall in front of the server

Browser reports too many redirects | Something in front of Nginx Proxy Manager talks to it over plain HTTP, for example a CDN proxy set to a flexible SSL mode, so every request looks like HTTP and gets redirected again | Set the upstream proxy to connect over HTTPS (a full or strict mode in Cloudflare-style setups), or turn off its proxying while testing

Redirect works but the page is broken or partly blank | The app builds plain HTTP links or expects to know it is behind HTTPS | The app's own setting for its public or base address, and the browser console for mixed-content warnings

Plain HTTP still loads | Force SSL wasn't saved, or the browser is showing a cached page | Reopen the host's SSL tab, then test again in a private window

A caution about HSTS

HSTS (HTTP Strict Transport Security) tells browsers to use HTTPS only for your domain for a set period, even before they reach your server. It strengthens the redirect, but browsers remember it, so it is hard to undo if your certificate later breaks or you need plain HTTP again. Turn it on only after the HTTPS version has worked reliably for a while. Enable the subdomains option only if every subdomain you use also has working HTTPS.

Why this matters for cameras and microphones

Modern browsers let web pages request the camera and microphone only in a secure context. In practice, that means a page served over HTTPS, with a narrow exception for pages opened from the same computer during development. On a page loaded over plain HTTP from another device, the browser won't show a permission prompt at all, and the page can't reach the webcam or microphone. A video-call or recording tool you self-host behind Nginx Proxy Manager can therefore seem broken simply because someone opened it with an http address. Forcing HTTPS fixes this by moving every visitor onto the secure version.

The redirect only removes this one obstacle. The following are separate questions to check one at a time:

• Access: whether the browser shows the permission prompt and the user or operating system allows it. HTTPS makes the prompt possible, but the browser's site settings and the operating system's privacy settings can still block it.
• Capture: whether a live picture actually appears and the microphone level actually moves. Another app may be using the device, or the wrong camera or input may be selected.
• Call quality: whether the image is clear and the speech is understandable to others. That depends on lighting, the microphone, the network and the call service, not on HTTPS.

Many browser-based call tools also need a live, two-way connection (WebSocket) between the page and the server. If the page loads over HTTPS but the call won't connect, check that Websockets Support is turned on in the proxy host's Details tab. Some self-hosted call apps also need extra ports for their media traffic that don't go through Nginx Proxy Manager at all. Their own documentation lists them, and the material supplied here did not cover any specific app.