Skip to main content

Don't worry this is an issue that many Drupal developers have come across. In particular it raises its head when you add a subdomain.  Your Drupal website is only showing a plain white screen with “The provided host name is not valid for this server" on it. What does it mean and how to fix it.

Drupal 8 added a security feature show it isn't possible to spoof the HTTP Host header and trick Drupal into using a different domain name.  Smart move.  So this doesn't occur, Drupal looked at the Symfony framework which already provided a trusted host mechanism, where site administrators could whitelist hostnames.  Trusted hosts can now be configured in Drupal through a new setting in settings.php.  The settings.php file is found in the following directory:

/sites/default/

Through Terminal or your shell program, open the file using the command

vi settings.php

We are going to quickly search for this script using the find command.  Which is to enter the / key, following by trusted_host_patterns.  See the following:

/trusted_host_patterns

Subsequently, you will now see the trusted_host_patterns expression:

​​​​​​​$settings['trusted_host_patterns']

How to add your domain as an expression to the trusted has patterns array:

$settings['trusted_host_patterns'] = array(
  '^www\.yourdomain\.com$',
);

Or if, for example, your using a subdomain stg, then you would include this:

$settings['trusted_host_patterns'] = array( 
  '^stg\.yourdomain\.com$',
);

However, if you would rather run your Drupal website off *.yourdomain.com and *.yourdomain.org, your settings.php would have to include this:

$settings['trusted_host_patterns'] = array(
  '^yourdomain\.com$',
  '^.+\.yourdomain\.com$',
  '^yourdomain\.org',
  '^.+\.yourdomain\.org',
);

Using regular expression patterns, you can build all sorts of rules.  For local development environments, you could include the following in your local.settings.php:

$settings['trusted_host_patterns'] = array(
  '^172\.0.\0.\1$',
  '^localhost$',
);

 

Related articles

Andrew Fletcher18 Mar 2024
Resolving CVE-2022-48624 less issue
To resolve the CVE-2022-48624 vulnerability on Ubuntu using Nginx, it's crucial to understand that the issue lies within the "less" package, not Nginx itself. The vulnerability affects "less" before version 606, where close_altfile in filename.c in less omits shell_quote calls for LESSCLOSE,...