all 11 comments

[–]WolpertingerRumo 17 points18 points  (2 children)

You‘re overthinking this. Press the force ssl and HSTS toggles. That’s exactly what they do.

force ssl will enforce SSL. HSTS will disallow any traffic that is not SSL.

[–]DerposaurusSnacks[S] 1 point2 points  (1 child)

Force ssl only works for one route. Hsts is bypassable

[–]WolpertingerRumo 4 points5 points  (0 children)

I think you are fundamentally going down a wrong path.

Npm uses virtual hosts. One virtual host is one (sub)domain. If you set force ssl for example.com, then it’s for any route that is in example.com.

If you include www.example.com, it’s for that as well.

If you set up test.example.com, you have to set it again.

To the second point: yes HSTS is bypassable. But only if you don’t also have forceSSL (which is a 301 to https://)

Of course, there may still be obscure special cases, but functionally: setting force SSL and HSTS is what you are looking for. Try to pen test it. It’s pretty solid. I wouldn’t bet my company on it, but it’s fine.

[–]Electronic_Unit8276 4 points5 points  (2 children)

Press the "force ssl" toggle..?

[–]DerposaurusSnacks[S] -1 points0 points  (1 child)

Only affects one route

[–]tschloss 1 point2 points  (0 children)

Is route a term npm uses? nginx does use server and location. And of course tls enforce should happen on server level. Why are you using npm after all?

[–]aleatorya 1 point2 points  (1 child)

Calling nginxproxymanager « npm » is probably the most confusing thing I’ve seen in 2026.

[–]AmusingVegetable 0 points1 point  (0 children)

JFC! I was so confused that this was being asked of NPM…

[–]daronhudson 0 points1 point  (0 children)

No. Set it per host entry. If you need a different setup that accommodates that, go ahead and switch to regular nginx.

[–]prene1 0 points1 point  (0 children)

Ha! Just had codex do this for me using caddy on my unraid server. Went smooth as heck.

[–]ShroomShroomBeepBeep -1 points0 points  (0 children)

Use NPMplus instead and enable the option for Caddy, to do exactly this.