Add a default server block in nginx

The fix/etc/nginx/conf.d/00-default.conf

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    return 444;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_reject_handshake on;
}

sudo nginx -t && sudo systemctl reload nginx

Why it matters

When a request arrives with a Host header that matches no server_name, nginx has to answer with something. Without an explicit default_server, it uses the first server block for that listen address — chosen by config load order, which is alphabetical filename order on Debian and Ubuntu.

So the site that answers for every scanner, every stale DNS record and every attacker probing by IP is whichever vhost happens to sort first. That’s an accident, and it has consequences:

• Your certificate is presented to anyone, for any name. TLS handshake first, Host check later — so a scanner probing your IP gets your certificate, which names your domains. That’s free reconnaissance.
• A stale DNS record keeps working. A domain that used to point at you, now owned by someone else, still resolves and still gets served your first vhost.
• Host-header confusion. Applications that build URLs from Host can be induced to emit links pointing at an attacker’s domain — password reset emails being the classic.

An explicit default block makes the answer a deliberate one: nothing.

ssl_reject_handshake is the good part

ssl_reject_handshake on (nginx 1.19.4+) rejects the TLS handshake without presenting a certificate at all. That is better than serving a self-signed cert or a dummy vhost, because it means an IP scan learns nothing — no names, no issuer, no expiry.

It needs no certificate configured, which also removes the usual chicken-and-egg of “what cert does the reject block use”.

return 444 on port 80 is nginx’s non-standard code meaning close the connection with no response. No body, no headers, no version banner — and no bandwidth spent on a scanner.

default_server is per listen address

Two things people get wrong:

• It’s a parameter of listen, not a standalone directive, and it applies per address:port. A default_server on 80 does nothing for 443. You need both, and both IPv4 and IPv6.
• Only one server block per address:port may carry it. A second one is a config error and nginx refuses to start — which is exactly why you test with nginx -t before reloading, since a pre-existing default in the packaged sites-enabled/default will collide with yours.

Verify it worked

Find out which block is currently the default:

sudo nginx -T 2>/dev/null | grep -n 'default_server'

No output means nginx picked one for you, and you should find out which:

sudo nginx -T 2>/dev/null | grep -E 'server_name|listen' | head -20

Then test it from the outside — request the IP directly with an unknown host:

curl -sI --resolve unknown.example:443:YOUR.IP https://unknown.example/ --max-time 5

Expect a TLS handshake failure, not a page. And on port 80:

curl -sI http://YOUR.IP/ --max-time 5

Expect an empty reply (that’s 444 working), not one of your sites.

Confirm no certificate is offered to an unknown name:

openssl s_client -connect YOUR.IP:443 -servername unknown.example </dev/null 2>&1 | grep -E 'subject=|alert|no peer certificate'

Seeing your real certificate’s subject= here means the reject block isn’t catching it.

Before you apply this

The risk is catching more than you meant to.

If any legitimate client reaches you without SNI, or with a Host you forgot to list, it now gets a hard rejection rather than the first vhost’s accidental hospitality. Usually that’s the goal. Occasionally it isn’t — health checks that request the IP directly, an old monitoring probe, or an internal caller using a hostname that never made it into server_name.

Before reloading, look at what hostnames are actually arriving:

log_format hosts '$remote_addr "$host" "$server_name" $status';
access_log /var/log/nginx/hosts.log hosts;

awk -F'"' '{print $2}' /var/log/nginx/hosts.log | sort | uniq -c | sort -rn | head -20

Every host in that list with real traffic needs a matching server_name somewhere, or it lands in the reject block.

Watch for a collision on reload. Debian and Ubuntu ship /etc/nginx/sites-enabled/default with default_server already set. Adding a second is a fatal config error — nginx -t will tell you, which is why you run it first. Remove or disable the packaged one:

sudo rm /etc/nginx/sites-enabled/default

Related

• Set security headers correctly — what your real vhosts should send.
• Hide the nginx version — the other reconnaissance surface.