What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reliable pattern is to keep your WebSocket application on a private listener such as 127.0.0.1:8080, let Nginx terminate TLS on the public hostname, and proxy a dedicated path such as /ws/ to that listener. Your browser then connects to wss://example.com/ws/. Nginx must use HTTP/1.1 upstream and explicitly forward the hop-by-hop Upgrade and Connection headers; when the application returns HTTP 101 Switching Protocols, Nginx changes from request proxying to a bidirectional tunnel.
This guide gives a complete VPS layout, a working Nginx configuration, deployment checks, timeout and keep-alive choices, and a diagnosis path for 400, 404, 502, 504, TLS, and one-minute disconnects.
Recommended Free Tools
What the finished connection looks like
A WebSocket deployment has three distinct hops:
- The client resolves your public hostname and opens a TCP connection to Nginx on port 443.
- Nginx completes the TLS handshake, receives an HTTP request containing
Upgrade: websocket, and forwards that request to the application over the internal network. - The application accepts the upgrade with HTTP
101 Switching Protocols. Nginx then maintains a tunnel so frames can travel in both directions until either side closes it.
The application does not need a public address. On a single VPS, bind it to localhost or another private interface and expose only Nginx. Use wss:// when the page itself is delivered over HTTPS; use ws:// only for an intentionally non-TLS service.
Prerequisites and network layout
Application listener
Know the exact address, port, and WebSocket route used by the application before editing Nginx. The examples assume the process listens on 127.0.0.1:8080 and accepts connections below /ws/. If the app listens on a Unix socket, a private LAN address, or another port, substitute that endpoint consistently in proxy_pass and in your local checks.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
DNS and firewall
Point the public hostname, such as example.com, at the VPS. Permit TCP 443 for the service. Keep TCP 80 available if you use it for certificate issuance or an HTTP-to-HTTPS redirect. Do not open port 8080 to the Internet when Nginx and the application share the VPS; allowing it only on localhost prevents clients from bypassing TLS, host validation, and access controls in the proxy.
Certificate
Install a certificate whose name covers the hostname clients will use. The TLS server block below shows the common full-chain and private-key paths under /etc/letsencrypt/live/example.com/; the issuer and renewal commands depend on your distribution and certificate tooling. A certificate for a different name will cause browsers and WebSocket clients to reject wss:// before Nginx can proxy anything.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use this Nginx configuration
Place the map in the global http context, not inside a server or location block. Put the two server blocks in the configuration included by your Nginx installation. Replace the hostname, certificate paths, internal port, and route when they differ.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
# In the http{} block
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location /ws/ {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}The HTTP block redirects ordinary browser requests to HTTPS. WebSocket clients should normally be configured with the final wss:// URL directly; many WebSocket libraries do not treat an HTTP 301 as a WebSocket upgrade redirect.
Why each directive matters
| Directive | Purpose | What to verify |
|---|---|---|
map $http_upgrade $connection_upgrade |
Returns upgrade when the client sent an Upgrade header and close otherwise. |
It belongs in http. This prevents ordinary requests handled by the same location from receiving an inappropriate Connection: upgrade. |
proxy_pass |
Selects the application listener. | Check the scheme, address, port, route, and trailing-slash behavior against the app’s routing rules. |
proxy_http_version 1.1 |
Uses HTTP/1.1 for the upstream handshake. | Nginx upstream proxying commonly defaults to HTTP/1.0; without this override, the upgrade can fail even when the public TLS connection is healthy. |
proxy_set_header Upgrade $http_upgrade |
Forwards the client’s requested protocol switch. | Nginx does not pass this hop-by-hop header automatically. |
proxy_set_header Connection $connection_upgrade |
Tells the upstream whether it should switch protocols. | The mapped value is safer for a location that might also receive ordinary HTTP. A fixed Connection upgrade is acceptable only for a location dedicated exclusively to WebSockets. |
proxy_set_header Host $host |
Preserves the public host name. | Applications often use it for URL generation, virtual-host routing, and origin checks. |
X-Real-IP and X-Forwarded-For |
Carry the client address through the proxy. | Configure the application framework to trust these headers only from your Nginx proxy. |
X-Forwarded-Proto $scheme |
Reports whether the original request was HTTP or HTTPS. | It prevents generated links and security checks from incorrectly treating a TLS request as plain HTTP. |
proxy_read_timeout 3600s |
Sets the maximum interval Nginx will wait for data from the upstream. | The documented default is 60 seconds. Choose a value appropriate for your application or send heartbeat frames. |
Understand the proxy_pass path
Path mismatches are a frequent cause of a handshake returning 404. With location /ws/ and proxy_pass http://127.0.0.1:8080; (no URI suffix), Nginx forwards the normalized request URI, including the /ws/ prefix. If you instead write proxy_pass http://127.0.0.1:8080/;, Nginx replaces the matching /ws/ prefix with /. Therefore a client request for /ws/chat reaches the application as /ws/chat in the first form and /chat in the second.
Choose the form that matches the route registered by your WebSocket server. Make the client URL, Nginx location, and backend route agree on spelling, case, and trailing slashes. Do not change the slash while troubleshooting several other variables at once.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Deploy it safely, step by step
- Confirm the process is listening. Check the application’s own status and verify that it is bound to the intended private address and port. A process listening only on another interface or port cannot answer Nginx.
- Confirm the route. Record the exact WebSocket path, including whether it is
/ws,/ws/, or a deeper route such as/ws/chat. Compare it with the Nginx location and the client URL. - Add the map. Insert the
mapin the Nginxhttpcontext. Defining it inside a server block produces a configuration error. - Add the WebSocket location. Place the location in the TLS-enabled server block, not only in the port-80 redirect block. Include HTTP/1.1, both upgrade headers, the host and forwarding headers, and an appropriate read timeout.
- Check the effective configuration. Run the configuration test command supplied by your platform, commonly
nginx -t. Do not reload until it reports a valid configuration and identifies the files you intended to edit. - Reload Nginx. Use your service manager’s reload operation, commonly
systemctl reload nginx. A reload applies the new workers without unnecessarily dropping established connections; follow your distribution’s service-management conventions. - Connect using the public URL. From an HTTPS page, create the socket with
wss://example.com/ws/. For a deliberately non-TLS HTTP deployment, usews://and ensure the client is not blocked by browser mixed-content rules. - Observe both logs. Watch Nginx access and error logs while making a new connection, and inspect the application log at the same time. The HTTP status, upstream error, requested path, and application message together are more useful than a browser’s generic “connection failed” notice.
Verify a handshake from a browser
The browser’s developer console is a simple end-to-end test because it exercises DNS, TLS, Nginx, and the application in one path:
const socket = new WebSocket('wss://example.com/ws/');
socket.addEventListener('open', () => console.log('WebSocket open'));
socket.addEventListener('message', event => console.log(event.data));
socket.addEventListener('error', event => console.error('WebSocket error', event));
socket.addEventListener('close', event => console.log('closed', event.code, event.reason));In the browser’s Network panel, a successful handshake is shown as HTTP 101 Switching Protocols. A 101 proves that the protocol switch was accepted; it does not prove that the application’s authorization, message handling, or business logic is correct, so continue checking the application log and exchanged frames.
Troubleshoot by symptom and status
| Symptom | Likely area | Checks and correction |
|---|---|---|
| Immediate close or HTTP 400 | Handshake headers or client request | Confirm the client actually sends an Upgrade request. Verify proxy_http_version 1.1, proxy_set_header Upgrade $http_upgrade, and proxy_set_header Connection $connection_upgrade. Then read the application and Nginx error logs; 400 is a heuristic, not proof of one cause. |
| HTTP 404 during the handshake | Path or trailing slash | Compare the client URL, Nginx location, and backend route. Check whether the URI form of proxy_pass is stripping or retaining the /ws/ prefix. |
| HTTP 502 Bad Gateway | Unreachable or unhealthy upstream | Verify that the process is running, the address and port are correct, the local firewall permits the connection, and the proxy_pass scheme matches the backend protocol. Test the listener locally from the VPS. |
| HTTP 504 or a gateway timeout | Upstream did not answer in time | Check the application’s accept loop and logs, then inspect Nginx timeout settings. A timeout is different from a rejected handshake; fix an unhealthy process before merely increasing a timer. |
| Disconnect after roughly one minute | Idle read timeout | Nginx’s documented default is 60 seconds without upstream data. Keep the longer proxy_read_timeout shown above or send periodic application-level WebSocket ping frames and handle pong responses. |
| Works over HTTP but not HTTPS | TLS server block or browser policy | Check that the certificate covers the public hostname, the client uses wss://, the page is not attempting mixed content, and the WebSocket location is present in the listen 443 ssl server block rather than only in the port-80 redirect. |
| Application sees the wrong IP or scheme | Forwarded-header handling | Confirm the three forwarding headers are present and configure the framework’s trusted-proxy setting to trust only your proxy. Never make an application trust arbitrary client-supplied forwarding headers when it is directly reachable. |
| Configuration test fails | Context, syntax, or duplicate server settings | Read the exact line reported by the configuration test. Common mistakes include putting map in the wrong context, misspelling a directive, or editing a file that is not included by the active Nginx configuration. |
Keep long-lived sockets alive
What the timeout measures
proxy_read_timeout is an idle interval between reads from the upstream, not a maximum lifetime for every socket. A connection that continuously carries data can remain open beyond the configured number of seconds. A quiet connection can be closed when the interval expires unless traffic resets the timer.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Choose a timeout deliberately
The example uses one hour (3600s) as a practical starting point for quiet sessions. Set a value that matches the application’s expected idle period and resource budget. A very long timeout leaves more idle connections attached to worker processes, while a short timeout forces reconnects for clients that legitimately remain silent.
Prefer protocol heartbeats
Application-level ping/pong frames make liveness explicit and keep intermediate network devices aware that the connection is still active. Implement the heartbeat in the WebSocket server and client, not as arbitrary HTTP requests. The client should treat a missed pong as a reason to reconnect, while the server should close dead peers so resources are reclaimed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.TLS, redirects, and browser rules
TLS terminates at Nginx in this layout. The internal hop to 127.0.0.1:8080 is plain HTTP unless the application itself is configured for TLS. That is normally acceptable when the listener is local and inaccessible from untrusted networks; use an encrypted upstream when traffic crosses a separate host or network that you do not fully control.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Use a hostname that matches the certificate and set the application URL to the same hostname clients use. A page loaded over HTTPS cannot normally open an insecure ws:// connection because browsers enforce mixed-content protections. Configure wss:// from the start for production HTTPS sites.
The port-80 redirect is useful for ordinary HTTP and certificate workflows, but it is not a substitute for configuring the WebSocket client with the correct secure scheme. If a library reports a redirect or handshake failure, replace a ws:// URL with the final wss:// URL and test again.
Header trust and application configuration
Nginx can preserve the public host, client address, and original scheme, but the application must be configured to interpret those headers correctly. Frameworks often have an explicit trusted-proxy list or hop count. Set it to the Nginx instance or private network you control. This allows secure URL generation and accurate logs without allowing a direct client to forge its apparent address or protocol.
Keep the WebSocket location narrow when possible. A dedicated /ws/ location reduces accidental interactions with ordinary HTTP handlers. If one location must serve both upgraded and non-upgraded requests, retain the conditional map; a hard-coded Connection upgrade can confuse ordinary requests.
Operational checklist
- The application is running and listening on the intended private address and port.
- The public DNS record resolves to the VPS.
- TCP 443 is reachable, and TCP 80 is available if needed for redirects or certificate issuance.
- The certificate name matches the hostname used in the
wss://URL. - The
mapis in thehttpcontext. - The TLS server block contains the WebSocket location.
- The upstream uses
proxy_http_version 1.1. - Both hop-by-hop upgrade headers are set explicitly.
- The
proxy_passslash behavior matches the backend route. - The configuration test succeeds before every reload.
- Nginx access and error logs and the application log are observed during a test connection.
- The idle timeout and application heartbeat interval are compatible.
- The backend port is not publicly exposed unless a separate, trusted component requires it.
How to interpret a successful setup
A correct deployment has a clear chain of evidence: the client reaches the certificate-bearing Nginx server, Nginx forwards an HTTP/1.1 upgrade with the required headers, the application returns 101, and subsequent frames remain open for the intended idle period. If any link fails, use the status and log branch above rather than changing several directives at random. Keeping the application private, matching the route exactly, and treating the upgrade headers and idle timeout as first-class settings are the foundations of a dependable WebSocket service behind Nginx.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
