iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To stop visitors from opening your website by its IP address, configure a default or catch-all virtual host on every exposed HTTP and HTTPS listener. That host must reject unknown Host values instead of falling through to your production site. If a CDN or reverse proxy sits in front of the server, also restrict origin access with a firewall allowlist, authenticated origin certificates, or an outbound-only tunnel when hiding the address alone is not sufficient.
Blocking port 80 only is incomplete: HTTPS certificate selection happens before the web server receives the HTTP request. Your origin can still answer on port 443 unless it has its own rejecting TLS default. The guide below shows how routing causes the leak, how to configure the common server types, how to add origin controls, and how to verify the result without taking the real domain offline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why a website responds when someone enters its IP address
A web server can host many sites on one IP address. It distinguishes them with the HTTP Host header (and, for HTTPS, the TLS Server Name Indication or SNI value). A browser requesting http://203.0.113.10/ sends an IP address as the host. If that value does not match a named virtual host, the server uses the default virtual host for that IP and port.
NGINX describes the rule directly: when the host value does not match any configured name, or the header is absent, the request is routed to the default server for that port. If your production site is the default, an IP request receives the same content as the domain. An IP can also match a broadly defined name, such as a wildcard or an accidentally included address.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
The fix is a deliberate separation:
- A default or catch-all server handles unknown names and returns a rejection.
- A separate production server block lists only the real domain names.
- The same arrangement exists independently on HTTP (usually port 80) and HTTPS (usually port 443).
This is virtual-host routing control, not an IP firewall. The listener remains reachable, and a client can still connect to the port. The goal is to prevent that connection from serving the application.
NGINX: create a rejecting HTTP default server
Put the catch-all block in the configuration that is loaded before, or alongside, your normal site definitions. The important setting is default_server; it makes the block the fallback for that address and port.
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name "";
return 444;
}NGINX documents server_name "" with return 444 for requests without a host header. The same default-server mechanism catches an IP host or another name that does not match a configured site. Status 444 is an NGINX-specific connection close. You may instead return 400 (bad request) or 421 (misdirected request) if your monitoring, load balancer, or support process requires a standard HTTP response.
Keep the real site in a different block and do not mark it as the default:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example;
index index.html;
# application-specific configuration
}If another enabled configuration already claims port 80 as the default, remove that designation or make the rejecting block the only explicit default. Duplicate defaults can cause startup errors or an unexpected selection.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
Reload safely
- Run
nginx -t(or the path used by your distribution) and confirm that the syntax test succeeds. - Reload rather than stop the service: use
systemctl reload nginxon a systemd host, or the equivalent NGINX reload command. - Watch the error log while testing. A syntax failure should leave the previous, working configuration in place; do not delete the old configuration until the new one has been verified.
NGINX: block direct access over HTTPS
HTTPS requires a second catch-all because TLS negotiation precedes the HTTP request. NGINX can select a certificate for the default HTTPS server before it knows which hostname the client intends. If the production block is the default on port 443, an IP request can receive its certificate and content even when port 80 is protected.
Create a rejecting TLS default. Most NGINX versions require a certificate and key on an ssl server, so use a certificate dedicated to the fallback rather than the production certificate:
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/tls/rejecting-default.crt;
ssl_certificate_key /etc/nginx/tls/rejecting-default.key;
return 444;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/tls/example.crt;
ssl_certificate_key /etc/nginx/tls/example.key;
root /var/www/example;
}The fallback must never contain the application root, proxy pass, redirects to the production site, or a shared authentication location. Depending on the client and certificate, an IP URL may fail with a certificate-name warning before an HTTP status is visible; that is acceptable as long as the fallback cannot return your site. Some NGINX releases and TLS policies offer additional handshake-level rejection features. Verify the exact directive and version in the NGINX documentation installed on your system before using one.
Reload only after testing both listeners. A configuration that rejects HTTP but leaves the production HTTPS block as the default still exposes the site by IP.
Apache, Caddy, HAProxy, IIS and ingress controllers
The principle is portable even though the syntax is not. Define an explicit default virtual host for each address and port, make it return a rejection, and configure the production host to match only its intended names. Check the current documentation for your server because default selection, wildcard precedence, TLS certificate handling, and available status codes differ.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
- Apache: place a rejecting first-listed or explicitly designated virtual host for port 80 and a separate TLS default for 443. Do not let the fallback inherit the production document root or proxy rules.
- Caddy: create a site address that catches unmatched requests and returns an error, while keeping the real hostname in its own site block. Confirm how automatic HTTPS handles the fallback.
- HAProxy: use a default backend or HTTP-request rule that denies unknown host headers on each frontend. Apply equivalent policy to TLS frontends, including SNI handling.
- IIS: configure bindings for the intended hostnames and a separate default site that has no application content. Review both HTTP and HTTPS bindings and certificate selection.
- Kubernetes or another ingress controller: define a default backend that returns an error and ensure no catch-all route points to the application service. Test the controller’s behavior for unknown SNI as well as unknown HTTP hosts.
Never copy NGINX directives directly into another product. The requirement is the same, but a seemingly correct-looking directive can be ignored or interpreted differently.
What a CDN or reverse proxy changes
When a DNS record is proxied through a CDN, normal DNS responses contain the proxy’s addresses rather than the origin address. That reduces casual discovery, but it does not make the origin private. An attacker who learns the origin IP can connect to it directly unless the origin enforces an additional policy.
Proxy edge behavior
Cloudflare returns Error 1003 when someone tries to access a Cloudflare IP directly and tells the visitor to use the domain name. This protects the edge address from being used as a generic web origin, but it does not protect your own server if its address is publicly reachable.
Firewall allowlisting
At the origin firewall, allow inbound web traffic only from the CDN’s published IP ranges, then deny other sources. Maintain the list when the provider changes it. Do not accidentally block those ranges: proxied visitors reach your origin through them, so an over-broad deny rule can take the public site offline. Keep administrative access (such as SSH) on a separate, tightly restricted path rather than adding it to the CDN allowlist.
Recommended Free Tools
Authenticated Origin Pulls
Authenticated Origin Pulls (AOP) adds client-certificate authentication between Cloudflare and the origin. With AOP enforced, an HTTPS request that does not present the required client certificate receives no origin response, so a direct connection cannot bypass the edge merely by knowing the IP.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Global AOP uses a certificate supplied by Cloudflare. Configure the origin to trust that certificate and require client authentication—for example, Apache uses SSLVerifyClient require and NGINX uses ssl_verify_client on in the TLS server. Zone-level AOP uses a certificate that you upload and is intended for stricter, account-specific control. Cloudflare requires Full or Full (strict) encryption for that setup. Certificate renewal, trust-store changes, and staged testing are part of operating either mode.
Cloudflare Tunnel
Cloudflare Tunnel uses an outbound-only connection from a connector in your environment to Cloudflare’s network. The origin does not need a publicly routable IP, so there is no inbound web listener for an attacker to reach. This is the strongest architectural option in the cited material when your application and traffic types are supported, but it introduces a connector process, its updates, and dependence on the tunnel’s supported protocols and health.
Choose the control that matches your threat model
| Option | What it blocks | Residual exposure | Operational considerations |
|---|---|---|---|
| NGINX or Apache catch-all | Unknown host values and direct-IP virtual-host routing | The IP and listener remain reachable. A deliberately forged host can still select a configured site unless another control is added. | Simple local configuration; cover HTTP and HTTPS and keep the fallback free of application content. |
| CDN proxy plus origin firewall allowlist | Connections that do not come from the CDN’s address ranges | Protection depends on an accurate, maintained allowlist; the ranges are shared by other visitors. | Automate or regularly review range updates and avoid rules that block proxied traffic. |
| Authenticated Origin Pulls | HTTPS requests without the required client certificate | Requires TLS and certificate lifecycle management. | Stronger origin authentication. A global provider certificate is shared; customer-uploaded, zone-level certificates provide tighter account control. |
| Cloudflare Tunnel | Public inbound origin access | Requires a running connector and a traffic model supported by the tunnel. | Outbound-only design and no publicly routable origin IP, with additional connector operations. |
Many deployments combine these controls: a catch-all prevents accidental virtual-host exposure, a firewall limits who can reach the origin, and AOP or a tunnel verifies that requests arrived through the intended path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A deployment procedure that avoids an outage
- Inventory listeners and names. Record every public IPv4 and IPv6 address, port, TLS listener, virtual host, API hostname, health-check hostname, and non-HTTP service. Include load balancers and ingress controllers, not just the web server.
- Save a rollback copy. Keep the currently deployed configuration and note the exact reload or restart command. Ensure you have console or out-of-band access in case a firewall change cuts off remote administration.
- Add the HTTP fallback. Make it the explicit default for every IPv4 and IPv6 address on port 80. Return 444, 400, or 421 according to your logging and client requirements.
- Add the HTTPS fallback. Make a TLS default for every address on port 443, provide the required fallback certificate, and return no application content. Confirm that the production certificate and server block are not the default.
- Check dependent traffic. Update monitoring, payment callbacks, API clients, certificate authorities, and health checks that legitimately use a hostname. A health check pointed at the IP will now fail by design and must be changed.
- Validate syntax and reload. Run the server’s configuration test, reload gracefully, and monitor access and error logs during the change.
- Add origin restrictions if needed. If a direct connection must be impossible, configure the CDN allowlist, AOP, or a tunnel after the local catch-all is working. Stage firewall changes so you retain an administrative path.
- Run the full verification matrix. Test both protocols, both IP families, unknown hosts, and the real domain before declaring the change complete.
Verification commands and expected results
Perform these checks from a network that is not implicitly trusted by an internal firewall. Substitute your actual origin address and domain.
- IPv4 HTTP:
curl -i --resolve example.com:80:203.0.113.10 http://example.com/tests the origin address while retaining the real host. To test the IP host itself, usecurl -i http://203.0.113.10/. The latter should receive the fallback rejection, not the site. - IPv4 HTTPS:
curl -vk https://203.0.113.10/should fail certificate validation or terminate at the rejecting TLS default; it must not return production content. The-koption is for diagnosis only. - IPv6: use bracketed literals, such as
curl -i http://[2001:db8::10]/andcurl -vk https://[2001:db8::10]/, if the server publishes IPv6. - Unknown host header:
curl -i -H 'Host: not-configured.example' http://203.0.113.10/should reach the catch-all. For HTTPS, usecurl -vk --resolve not-configured.example:443:203.0.113.10 https://not-configured.example/to send matching SNI and Host values to the origin. - Real domain: request the normal HTTP and HTTPS URLs through their usual DNS path. They should continue to return the intended application, certificate, redirects, and status codes.
- AOP, when enabled: make a direct-origin HTTPS request without the client certificate and confirm that it fails client authentication. Then make a normal request through the CDN and confirm it succeeds. Cloudflare specifically recommends direct-origin curl verification after AOP enforcement.
Record response codes, TLS errors, the selected certificate, and server logs. A connection reset, a 4xx response, or a TLS client-authentication failure can all be an intentional success for the direct-IP test; the decisive check is that no production response body is returned.
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Troubleshooting common failures
The IP still serves the site over HTTP
- The rejecting block is not actually the default for the address being tested. Check every
listenline, including IPv6, and inspect the server’s complete loaded configuration. - Another enabled file declares
default_server. Remove the duplicate or make the intended fallback explicit. - A wildcard or IP value appears in the production
server_name. Remove names that should never select the application. - A load balancer or ingress in front of NGINX is answering first. Apply the same catch-all policy at that layer.
The IP still serves the site over HTTPS
- Port 443 has no rejecting default, or the production TLS block is still marked
default_server. - The request is reaching a different address, such as an old IPv6 record or an unretired load-balancer IP.
- The TLS fallback proxies or redirects to the application. Remove all content and proxy directives from it.
- A certificate warning is being mistaken for protection. A warning does not prove the origin rejected the request; inspect the HTTP response and body after deliberately bypassing certificate verification in a controlled test.
The public site fails after enabling an origin firewall
Verify that the CDN’s current ranges are allowed on both IPv4 and IPv6, that the firewall rule applies only to web ports, and that health checks originate from an allowed source or use a separate internal endpoint. Keep an emergency management rule restricted to your own administration addresses.
APIs or monitoring break
Update clients to use the documented hostname and send the expected SNI and Host values. Replace IP-based health checks, webhook destinations, and certificate probes with hostname-based checks where possible. If a non-HTTP protocol cannot traverse the selected CDN or tunnel, keep it on a separately protected listener rather than weakening the web policy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLimits of IP blocking and further hardening
A catch-all does not erase the address from historical DNS data, certificates, server banners, email records, or old documentation. It also does not prevent network-level scans or attacks against unrelated services on the same host. Close unused ports, patch the operating system and web server, and use network access controls for administration.
Host-header rejection is not a substitute for application authentication. A client can forge a valid host header; the catch-all only prevents unknown names from accidentally selecting a site. Use firewall restrictions, AOP, or a tunnel when the requirement is that every accepted request must arrive through a specific proxy.
Finally, document the intended behavior: direct IP and unknown-host requests must fail, while the canonical domain must continue to work on both protocols. Re-run that matrix after certificate renewals, DNS changes, new virtual hosts, load-balancer migrations, and server upgrades.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
