一,问题背景
当网站新增别名域名(如 dh.ally.ren)时,仅修改DNS解析是不够的.如果Nginx配置中未将该域名加入HTTPS跳转与防盗链白名单,用户访问新域名时可能遭遇证书报错或CSS/JS资源加载失败.本文详细说明新增域名后必须修改的两处核心配置,并提供可直接使用的完整代码.
二,修改场景说明
假设主站域名为 wangzhi.aiqixie.com,旧域名包括 www.wangzhi.best,wangzhi.best,wangzhi.ally.ren,现新增 dh.ally.ren 作为入口域名之一.目标效果为:
所有HTTP请求统一301跳转至主站HTTPS,集中权重
所有旧域名HTTPS请求301跳转至主站,避免内容重复
主站静态资源(JS/CSS)允许新域名作为Referer合法来源
三,核心修改点详解
1. HTTPS跳转server_name追加域名
在443端口的旧域名跳转server块中,必须将 dh.ally.ren 加入server_name列表.若遗漏此项,用户直接访问 https://dh.ally.ren 时,Nginx会因找不到匹配的server块而返回默认站点或证书错误.
server {
listen 443 ssl http2;
server_name www.wangzhi.best wangzhi.best wangzhi.ally.ren dh.ally.ren;
ssl_certificate /www/server/panel/vhost/cert/www.wangzhi.best/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/www.wangzhi.best/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000";
return 301 https://wangzhi.aiqixie.com$request_uri;
}证书兼容性提醒: 该server块引用的SSL证书必须覆盖 dh.ally.ren,否则浏览器会先提示"证书域名不匹配"的安全警告,再执行301跳转.若证书不包含该域名,建议在宝塔面板为其申请独立证书,或更换为包含所有域名的多域名证书.
2. 防盗链valid_referers添加白名单
主站静态资源location中,valid_referers指令用于限制JS/CSS的引用来源.若遗漏新域名,从 dh.ally.ren 访问主站时,浏览器控制台会报404错误,导致页面样式或功能异常.
location ~* \.(js|css|mjs)$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000";
access_log off;
log_not_found off;
valid_referers none blocked wangzhi.aiqixie.com www.wangzhi.best wangzhi.best wangzhi.ally.ren dh.ally.ren;
if ($invalid_referer) {
return 404;
}
}四,完整配置文件参考
以下是修改后的完整Nginx配置,可直接用于宝塔面板站点配置文件:
# 1. 所有域名的HTTP请求统一跳转主站HTTPS
server {
listen 80;
server_name www.wangzhi.best wangzhi.best wangzhi.ally.ren wangzhi.aiqixie.com dh.ally.ren;
location ~ /\.well-known { allow all; }
return 301 https://wangzhi.aiqixie.com$request_uri;
}
# 2. 旧域名HTTPS跳转至主站HTTPS
server {
listen 443 ssl http2;
server_name www.wangzhi.best wangzhi.best wangzhi.ally.ren dh.ally.ren;
ssl_certificate /www/server/panel/vhost/cert/www.wangzhi.best/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/www.wangzhi.best/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;
return 301 https://wangzhi.aiqixie.com$request_uri;
}
# 3. 主站HTTPS业务逻辑
server {
listen 443 ssl http2;
server_name wangzhi.aiqixie.com;
root /www/wwwroot/www.wangzhi.best;
index index.php index.html index.htm default.php default.htm default.html;
ssl_certificate /www/server/panel/vhost/cert/www.wangzhi.best/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/www.wangzhi.best/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000";
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
try_files $uri /index.php?$args;
fastcgi_pass unix:/tmp/php-cgi-80.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
if ($request_method !~ ^(GET|POST|HEAD)$) { return 444; }
# 安全防护规则
autoindex off;
location ~ ^/zb_users/(theme|plugin)/.*/$ { return 404; access_log off; log_not_found off; }
location ~ ^/zb_system/$ { return 404; access_log off; log_not_found off; }
location ~* ^/(wp-admin|wp-content|wp-includes|xmlrpc\.php|wp-login\.php) { return 444; access_log off; }
location ~* ^/(webroot|admin|phpmyadmin|pma)/ { return 444; access_log off; }
location ~* \.php/.+$ { return 404; access_log off; }
# JS/CSS防盗链
location ~* \.(js|css|mjs)$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000";
access_log off;
log_not_found off;
valid_referers none blocked wangzhi.aiqixie.com www.wangzhi.best wangzhi.best wangzhi.ally.ren dh.ally.ren;
if ($invalid_referer) { return 404; }
}
# 图片/媒体/字体缓存
location ~* \.(jpg|jpeg|png|gif|svg|webp|avif|ico|bmp|swf|woff2|woff|ttf|otf|eot|mp4|webm|ogv|mp3|ogg|wav|aac|flac|opus|weba|pdf|zip|gz|bz2|xz|webmanifest|map|wasm)$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
access_log off;
log_not_found off;
}
# 禁止访问敏感文件与目录
location ~* (\.user\.ini|\.htaccess|\.env.*|\.gitignore|LICENSE|README\.md|composer\.json|composer\.lock|package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|\.swp|\.bak|\.old|\.tmp|\.log|\.sql(\.gz)?|docker-compose\.yml|Dockerfile)$ { return 404; }
location ~* /(\.git|\.svn|\.vscode|\.idea|\.ssh|\.github|node_modules|runtime)/ { return 404; }
location = /robots.txt { allow all; log_not_found off; }
location = /sitemap.xml { log_not_found off; }
gzip on;
gzip_min_length 1k;
gzip_comp_level 6;
gzip_types text/plain application/javascript text/css application/xml application/json image/svg+xml;
gzip_vary on;
access_log /www/wwwlogs/www.wangzhi.best.log;
error_log /www/wwwlogs/www.wangzhi.best.error.log;
}五,修改检查清单
每次新增域名后,建议按照以下清单逐项核对,避免遗漏:
HTTP 80端口server_name已包含新域名
HTTPS 443旧域名跳转server_name已包含新域名
防盗链valid_referers已包含新域名
SSL证书已覆盖新域名或已申请多域名证书
配置语法测试通过: nginx -t
服务已平滑重载: nginx -s reload
六,常见问题排查
Q: 访问 https://dh.ally.ren 时浏览器提示证书不安全?
A: 说明当前证书未覆盖该域名.请在宝塔面板中为 dh.ally.ren 申请证书,并替换443跳转块中的ssl_certificate路径.
Q: 新域名访问主站时页面样式丢失?
A: 检查主站server块中JS/CSS防盗链的valid_referers是否已加入该域名,并清除浏览器缓存后重试.
Q: 修改后Nginx启动失败?
A: 执行 nginx -t 查看具体报错行号,常见原因是证书路径错误或server_name后缺少分号.
七,结语
新增域名后,Nginx配置的修改核心在于跳转入口与资源引用来源两个维度.通过server_name与valid_referers的同步更新,可以确保SEO权重集中与防盗链策略不受影响.建议在正式环境修改前,先在测试服务器验证配置语法,确认无误后再上线.