diff --git a/sites/40k-rankings/40k-rankings.gateway-gamers.net.conf b/sites/40k-rankings/40k-rankings.gateway-gamers.net.conf
index 2a57242..1a99d45 100644
--- a/sites/40k-rankings/40k-rankings.gateway-gamers.net.conf
+++ b/sites/40k-rankings/40k-rankings.gateway-gamers.net.conf
@@ -1,37 +1,11 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name 40k-rankings.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name 40k-rankings.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/40k-rankings;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
     server_tokens off;
 
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +17,25 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
 }
+server {
+    if ($host = 40k-rankings.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name 40k-rankings.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
+}
\ No newline at end of file
diff --git a/sites/aos-rankings/aos-rankings.gateway-gamers.net.conf b/sites/aos-rankings/aos-rankings.gateway-gamers.net.conf
index e9470e9..12e728a 100644
--- a/sites/aos-rankings/aos-rankings.gateway-gamers.net.conf
+++ b/sites/aos-rankings/aos-rankings.gateway-gamers.net.conf
@@ -1,37 +1,11 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name aos-rankings.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name aos-rankings.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/aos-rankings;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
     server_tokens off;
 
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +17,25 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
 }
+server {
+    if ($host = aos-rankings.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name aos-rankings.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
+}
\ No newline at end of file
diff --git a/sites/kingmaker/kingmaker.gateway-gamers.net.conf b/sites/kingmaker/kingmaker.gateway-gamers.net.conf
index 839e3f7..6269a92 100644
--- a/sites/kingmaker/kingmaker.gateway-gamers.net.conf
+++ b/sites/kingmaker/kingmaker.gateway-gamers.net.conf
@@ -1,37 +1,9 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name kingmaker.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name kingmaker.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/kingmaker;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/kingmaker.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/kingmaker.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
-    server_tokens off;
-
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; frame-src https://docs.google.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +15,36 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/kingmaker.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/kingmaker.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+    
+
+    # Hide nginx version
+    server_tokens off;
+      
+    # Security headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; frame-src https://docs.google.com; img-src 'self' data:;" always;
+}
+server {
+    if ($host = kingmaker.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name kingmaker.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
 }
diff --git a/sites/scouting/scouting.gateway-gamers.net.conf b/sites/scouting/scouting.gateway-gamers.net.conf
index 9a8acce..2508679 100644
--- a/sites/scouting/scouting.gateway-gamers.net.conf
+++ b/sites/scouting/scouting.gateway-gamers.net.conf
@@ -14,8 +14,8 @@ server {
     index index.html;
 
     # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/scouting.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/scouting.gateway-gamers.net/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/scouting.gateway-gamers.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/scouting.gateway-gamers.net/privkey.pem;
     # include /etc/letsencrypt/options-ssl-nginx.conf;
     # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
@@ -35,8 +35,6 @@ server {
     # style attribute).
     add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
 
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -49,3 +47,4 @@ server {
         try_files $uri $uri/ =404;
     }
 }
+