Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To force HTTPS on a self-hosted ownCloud server, first make the public hostname work over TLS, then configure the port-80 web server or reverse proxy to issue a permanent 301 redirect to the HTTPS URL. If TLS ends at a proxy, also tell ownCloud which proxy is trusted and, when detection is wrong, set its public protocol, host, and webroot in config/config.php. Add HSTS only after certificates, renewals, and every required subdomain have been verified.
What “force HTTPS” actually changes
HTTPS is not an ownCloud application switch. It is a property of the connection between the client and the edge server that first receives the request. The edge may be Apache or Nginx on the ownCloud host, or a separate load balancer, reverse proxy, or CDN. That edge presents the TLS certificate and accepts connections on port 443. A separate port-80 virtual host then redirects clients to the equivalent HTTPS URL.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesownCloud’s security guidance warns that using the service over unencrypted HTTP permits man-in-the-middle attacks and interception of data and passwords. A redirect protects users only after HTTPS is already functioning: a browser must be able to complete the initial secure connection before it can follow any policy that sends future HTTP requests to HTTPS.
When a proxy terminates TLS, the connection from the proxy to ownCloud may be plain HTTP even though the user’s connection was encrypted. Without correct proxy trust and URL overrides, ownCloud can therefore generate http:// links, redirect to an internal hostname, or advertise the wrong WebDAV endpoint. The implementation has two separate parts:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- Edge enforcement: certificate, HTTPS listener, and the HTTP-to-HTTPS redirect.
- Application awareness: trusted proxy and public URL settings so ownCloud builds links from the external HTTPS address.
Choose where TLS terminates
Decide which component owns the certificate and redirect before editing ownCloud. The same principles apply to each design, but the operational responsibilities differ.
| Architecture | Certificate and redirect owner | ownCloud settings to review | Operational concern |
|---|---|---|---|
| Apache or Nginx on the ownCloud host | The web server’s HTTPS and port-80 virtual hosts | Usually the normal public hostname; proxy settings are unnecessary unless another intermediary exists | Renewal, TLS configuration, and firewall exposure are managed on the application host |
| Dedicated Nginx, HAProxy, or similar reverse proxy | The separate proxy | trusted_proxies; overwriteprotocol, overwritehost, or overwritewebroot when ownCloud misdetects them |
Forwarded host, protocol, and client-address handling must be correct and restricted to known proxy addresses |
| Cloud edge proxy in front of your server | The cloud edge, with the origin path configured to match your security design | The same trusted-proxy and overwrite considerations as any TLS-terminating proxy | Keep the public hostname, edge policy, origin routing, and certificate lifecycle aligned |
| Containerized ownCloud behind a proxy | The external proxy or the container’s web server, depending on the deployment | Docker domain, trusted-domain, overwrite-URL/protocol, and trusted-proxy environment variables | Define one public HTTPS hostname consistently in the proxy and container configuration; pin an explicit image version |
Do not configure a second component to perform a different redirect unless you understand the request flow. A redirect loop commonly occurs when the proxy says the request is HTTPS but the origin treats it as HTTP and redirects back to the same public URL.
Pre-change checklist
Complete these checks before changing the port-80 virtual host or application configuration:
- The public DNS name, such as
cloud.example.com, resolves to the server or proxy that will accept traffic. - Port 80 reaches the intended edge for the redirect, and port 443 reaches the HTTPS listener. Firewalls, security groups, and upstream NAT must permit both paths during the transition.
- You have a valid certificate whose name covers the public hostname. Test the certificate from an external network, not only from the LAN.
- You know whether TLS ends on Apache, Nginx, HAProxy, a cloud proxy, or another component. Only that component should be treated as the TLS authority.
- You have a backup of
config/config.phpand a way to undo the web-server change if the site becomes unavailable. - If a proxy is involved, record its fixed source IP addresses or ranges. Those addresses, not every client address, belong in
trusted_proxies.
Keep a maintenance path available. Apply the HTTPS virtual host and test it directly before making the port-80 redirect permanent. If the certificate is wrong or the HTTPS listener cannot reach ownCloud, a redirect turns a visible HTTP site into an inaccessible one.
Implementation sequence
- Point DNS and route the ports. Direct the public hostname to the chosen edge and verify that ports 80 and 443 arrive there.
- Install the certificate. Configure the certificate and private key on the TLS-terminating web server or proxy. Confirm that the complete certificate chain is presented.
- Make the HTTPS virtual host work first. Preserve the original public host header and, when a proxy is used, forward the original protocol information to the origin.
- Add the permanent redirect. Configure the port-80 virtual host to return HTTP status 301 with the same path on the HTTPS scheme.
- Declare proxy trust when needed. Add only the proxy’s address to
trusted_proxies; never trust arbitrary client-supplied forwarding headers. - Correct ownCloud’s public URL detection. Set
overwriteprotocoltohttps, and add host or webroot overrides only when the generated URL proves that those values are misdetected. - Exercise real workflows. Test sign-in, file access, sharing links, WebDAV clients, and cron-generated URLs through the public HTTPS name.
- Enable HSTS last. Add the strict transport policy only after renewal and every required subdomain have been checked.
Configure Apache for the HTTP-to-HTTPS redirect
On Apache, keep a port-80 virtual host for the public name and make it issue a permanent redirect. The documented pattern is:
<VirtualHost *:80>
ServerName cloud.example.com
Redirect permanent / https://cloud.example.com/
</VirtualHost>Replace the example hostname with the exact name users enter. The redirect preserves the path and query string while changing the scheme, so a request such as /remote.php/dav/files/alice/report.odt is sent to the corresponding HTTPS path. Keep the HTTPS virtual host separate and verify it serves ownCloud normally before enabling this block.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A 301 is intentionally cacheable. During rollout, test with a fresh private browser window and command-line requests so an old redirect is not mistaken for the current configuration. Once the result is correct, leave the redirect in place for clients and bookmarks that still use HTTP.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Configure a reverse proxy without confusing ownCloud
With Nginx, HAProxy, a cloud edge, or another proxy, the proxy accepts HTTPS and forwards the request to ownCloud. The proxy must pass the original public host and protocol in the forwarding headers expected by the origin. The port-80 listener belongs at that edge; redirecting on the origin alone does not prevent an HTTP request from reaching the proxy or create a secure client connection.
ownCloud gives trusted proxies special treatment because forwarded headers can otherwise be supplied by an untrusted client. In config/config.php, list the address of the proxy that connects to ownCloud:
'trusted_proxies' => ['10.0.0.10'],Use the real, stable source address seen by the ownCloud host. If several controlled proxies can connect directly, list each one explicitly. Do not use a broad network or the public internet as a trusted proxy range. An incorrect trust list can let a requester spoof the apparent client address or other forwarded request information.
Recommended Free Tools
After trust is configured, inspect a generated link and a redirect response. If ownCloud still believes the request was HTTP, set the protocol override:
'overwriteprotocol' => 'https',The documented value is either http or https. This setting is specifically useful when TLS is handled by the proxy and the origin cannot see the encrypted leg.
If links use an internal name instead of the public one, add a host override:
'overwritehost' => 'cloud.example.com',If ownCloud is published below a path rather than at the domain root, set the public webroot:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
'overwritewebroot' => '/',The slash in this example represents a root deployment. For a path-based deployment, use the externally visible path instead. Do not add all three overrides automatically. Keep values that are already detected correctly out of the file; unnecessary overrides make later proxy or hostname changes harder to diagnose.
A complete example for a proxy at 10.0.0.10 serving the root hostname is:
'trusted_proxies' => ['10.0.0.10'],
'overwriteprotocol' => 'https',
'overwritehost' => 'cloud.example.com',
'overwritewebroot' => '/',Edit the existing configuration array with the file’s established PHP syntax and permissions. Do not create a second configuration file or expose its contents through the web server.
Docker deployments: keep the public identity consistent
In Docker, a proxy can be perfectly configured while the container still advertises an internal name or HTTP URL. The official Docker documentation calls out these settings:
OWNCLOUD_DOMAINidentifies the public domain used by the deployment.OWNCLOUD_TRUSTED_DOMAINSdefines hostnames ownCloud is allowed to serve.OWNCLOUD_OVERWRITE_CLI_URLcontrols the URL used by command-line and background operations.- The Docker environment reference also exposes overwrite protocol, host, webroot, and trusted-proxy settings for deployments where those values cannot be inferred.
Set the public HTTPS hostname consistently in the proxy configuration, container environment, and ownCloud trusted-domain settings. A mismatch can produce a login that appears to work in a browser while links sent by notifications, WebDAV clients, or scheduled jobs point to an internal address.
Use an explicit ownCloud image version rather than the latest tag. Pinning the image makes a configuration change reviewable and prevents an unrelated image update from changing behavior during the HTTPS migration. After changing environment variables, recreate the container using your normal deployment procedure so the running process receives the new values; then verify the effective configuration from the application’s behavior.
Add HSTS only after HTTPS is dependable
HTTP Strict Transport Security (HSTS) tells a browser to replace future HTTP requests with HTTPS before contacting the server. On the TLS virtual host, ownCloud’s example uses:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Strict-Transport-Security: max-age=15768000; includeSubDomains; preloadmax-age=15768000 is the policy duration in seconds. includeSubDomains extends the rule to every subdomain, not just the ownCloud hostname. Use it only when every relevant subdomain is already HTTPS-capable, including forgotten administrative, mail, API, and development names that users may visit.
The preload token signals intent for browser preload programs; it does not repair a broken certificate or an HTTP-only host. HSTS is therefore a policy decision, not a substitute for the port-80 redirect. If the certificate later expires or a required subdomain cannot serve HTTPS, browsers that have cached the policy may refuse access until the policy expires. Test renewal, alternate hostnames, and recovery procedures before adding the header.
Verify the result from the user’s perspective
Check each request path through the public hostname, not only by connecting directly to the origin:
- HTTP navigation: request an HTTP URL and confirm one 301 response to the equivalent HTTPS URL. Watch for chains that bounce between HTTP and HTTPS or between public and internal hostnames.
- HTTPS certificate: confirm the certificate name, validity dates, and chain from an external client. Test the exact hostname users will enter.
- Login and session: sign in, refresh, sign out, and sign in again. A secure page that immediately redirects to HTTP indicates an application or proxy-protocol mismatch.
- Generated links: create a share link, inspect notification URLs, and open links in a separate browser profile. Every public URL should use the HTTPS hostname.
- WebDAV: connect a desktop or mobile WebDAV client using the HTTPS endpoint. Test listing, upload, download, rename, and delete operations; WebDAV paths often reveal an incorrect webroot or host override.
- Background jobs: run a scheduled task or cron action and inspect any URL it records or sends. For containers, check the command-line URL setting as well as browser links.
- Proxy identity: review access logs at the proxy and origin. The origin should see the proxy as its network peer while ownCloud receives the original public host and protocol through trusted forwarding information.
Also test a path that contains encoded characters, a query string, and a long WebDAV path. These cases confirm that the redirect changes only the scheme and does not discard application routing data.
Troubleshooting common failures
Redirect loop between HTTP and HTTPS
This usually means the edge terminates TLS but the origin believes every forwarded request is HTTP. Confirm that the proxy sends the original protocol, that its address is in trusted_proxies, and that overwriteprotocol is set to https when detection remains wrong. Ensure only one layer is responsible for the public redirect.
Pages are HTTPS, but links are HTTP
The browser’s connection can be secure while ownCloud constructs URLs from the origin connection. Review overwriteprotocol first. If the hostname is also wrong, review overwritehost; if the path is wrong, review overwritewebroot. Remove stale or conflicting overrides after correcting the proxy headers.
Links point to an internal hostname or port
Set the public host override only when the proxy’s host header cannot be preserved. Then check that the public hostname is present in the trusted-domain configuration, especially in Docker. A correct certificate does not make an internal hostname publicly reachable.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Users receive a certificate warning
Check that the certificate covers the exact public name, that the edge serves the complete chain, and that DNS reaches the server holding the certificate. If a proxy and origin both serve certificates, test the client-facing edge separately from the internal connection. Do not work around a warning by enabling HSTS; HSTS makes certificate errors harder to bypass.
WebDAV fails while the browser works
Inspect the externally visible webroot and the complete WebDAV path. A missing or incorrect overwritewebroot can produce a valid-looking homepage while clients call the wrong endpoint. Confirm that the proxy forwards the method, path, authorization headers, and HTTPS scheme without rewriting them unexpectedly.
Client IP addresses look wrong
ownCloud may show the proxy address unless trusted forwarding is configured, but trusting every source is unsafe. Restrict trusted_proxies to the actual proxy addresses, then verify the proxy’s header behavior and the origin logs. Incorrect forwarded-header settings can allow clients to spoof their apparent address.
Docker changes appear to have no effect
Environment variables affect the container created with them, not an already running process that was never recreated. Check the deployment definition, recreate the container, and retest generated URLs. Keep the image version explicit so a restart does not silently introduce an unrelated version change.
Operating HTTPS after the migration
HTTPS enforcement is an ongoing operation rather than a one-time redirect. Monitor certificate expiration and renewal failures at the component that terminates TLS. A renewed certificate must be loaded by that component and tested from outside the network. If the proxy and origin have separate certificates, document which one users see and which one is used internally.
Keep the public hostname as the single canonical address in documentation, bookmarks, mobile profiles, WebDAV configurations, automation, and notification templates. When changing domains, update DNS, the certificate, trusted domains, proxy routing, Docker variables, and ownCloud overwrite values as one change set. Test old links and decide whether they should redirect, remain unavailable, or be retired.
Review the trusted-proxy list whenever infrastructure changes. A new load balancer, container network, or failover address may need to be added; an old address should be removed. Treat forwarding headers as security-sensitive input and limit direct access to the origin so clients cannot bypass the controlled edge.
Finally, document the rollback: how to disable HSTS if it was not yet cached broadly, how to restore the previous virtual host, where the certificate is stored, and which container or service must be restarted. This turns certificate or proxy failures into a recoverable maintenance event rather than an extended outage.
Quick Recap
Configuration decision table
| Symptom | First place to inspect | Likely setting or action |
|---|---|---|
| HTTP remains accessible without redirect | Port-80 edge virtual host | Add the permanent 301 redirect after HTTPS is confirmed |
| HTTPS request loops | Proxy protocol forwarding and ownCloud URL detection | Trust the proxy and set overwriteprotocol to https when required |
| Generated hostname is internal | Forwarded host and public URL configuration | Preserve the public host or set overwritehost |
| Generated path is missing or duplicated | Proxy path mapping and application webroot | Correct path forwarding or set overwritewebroot to the external path |
| Client address is always the proxy | Trusted forwarding configuration | Use a precise trusted_proxies list and verify proxy headers |
| Browser refuses a site after HSTS | Certificate, renewal, or a subdomain covered by policy | Repair HTTPS service; do not expect HSTS to provide an override |
What a finished deployment should look like
- The public hostname resolves to the intended edge, and port 443 presents a valid certificate.
- An HTTP request receives one permanent redirect to the same HTTPS path.
- ownCloud-generated links, sharing URLs, WebDAV endpoints, and background-job URLs use the public HTTPS hostname.
- Only known proxy addresses are trusted, and the proxy supplies accurate host and protocol information.
- Docker’s domain, trusted domains, overwrite URL/protocol values, and image version are deliberate and documented when containers are used.
- HSTS is enabled only after certificate renewal and all covered subdomains have passed testing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
