Enforcing site-wide HTTP-to-HTTPS or canonical domain redirects can accidentally break automated ACME Let’s Encrypt SSL renewal checks (.well-known/acme-challenge/), API webhooks, or load balancer health probes. Excluding specific file paths or extensions from global redirects requires targeted server blocks.

Nginx: Exclude Paths from Global 301 Redirects

/etc/nginx/sites-available/defaultnginx
server {
    listen 80;
    server_name example.com www.example.com;
 
    # Exclude Let's Encrypt ACME challenge directory from HTTP -> HTTPS redirect
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }
 
    # Exclude Health Check API endpoint
    location = /healthz {
        return 200 "OK";
        add_header Content-Type text/plain;
    }
 
    # Redirect ALL other HTTP requests to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}