diff --git a/docs/user-guide/tls.md b/docs/user-guide/tls.md
index 097c5c35e..cc2ef088b 100644
--- a/docs/user-guide/tls.md
+++ b/docs/user-guide/tls.md
@@ -23,7 +23,7 @@ The resulting secret will be of type `kubernetes.io/tls`.
 NGINX provides the option to configure a server as a catch-all with
 [server_name](http://nginx.org/en/docs/http/server_names.html)
 for requests that do not match any of the configured server names.
-This configuration works without out-of-the-box for HTTP traffic.
+This configuration works out-of-the-box for HTTP traffic.
 For HTTPS, a certificate is naturally required.
 
 For this reason the Ingress controller provides the flag `--default-ssl-certificate`.