Wrong website being served

If you look at your sites in Forge do you still have one named default? You shouldn't.

There's no default site. Would it help if I posted the contents of the Nginx file for the website?

I would not post anything that could possibly be used to thwart security on an open forum. I assume that both of your DNS entries have the same IP address. The second thing to compare is in the .env of each to be sure that the APP_URL values point to the specific URL and not to an IP address like below.

APP_URL=https://www.website1.com

Yes the domains all have A records to the server IP and all of the websites in Forge have the correct APP_URL setting, which is why I'm a bit stuck!

Could it be a DNS issue? Or Nginix unable to load the correct config files and therefore the first website in the list is being served?

Have you restarted Nginix to make sure that your not running a cached version?

You should have repeating server blocks like below in your Nginix config file:

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.website1.com;

I've just checked the website over a proxy and it is loading - but it's trying to load the SSL certificate of the first website in Forge (alphabetical order), so it's website2.com - trying to load SSL of website1.com. Hopefully this is narrowing it down :)

Have you double checked your SSL settings in Forge to ensure that you have two Certs and that the correct file is assigned to each domain?

Unfortunately Nginx doesn't want to restart:

Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.

I've just started using Origin SSL certificates with Cloudflare, could this be causing a problem?

I don't know about Cloudflare's certs but I assume that you have uploaded them onto your server through the Forge interface. If Nginx wont restart I would expect that you have accidentally made a change to the file.

Thanks for all your help :) Unfortunately I think it could have been down to me pasting the certificate in to the private key field on one of the websites!

It has happened previously - a different site being served, but I'm assuming this is Nginx needing restarted, so I will make a note in the future to make sure Nginx is restarted to avoid any cache issues.

Thanks again for your help and time!