I am running a Drupal 8 website, and when I browse to any page, I get a plain white page with just the following error message on it.

The provided host name is not valid for this server.

What does this mean? How do I fix this?


This error message is coming from a feature that was added to Drupal 8 to protect against HTTP Host header attacks. The feature is also described in the change record that was generated for the patch.

Essentially, it was possible to spoof the HTTP Host header for nefarious purposes, and trick Drupal into using a different domain name in several subsystems (particularly link generation). In other words, the HTTP Host header needs to be considered user input, and not trusted.

To combat this, a new setting, $settings['trusted_host_patterns'], was added to Drupal 8 to configure a list of "trusted" hostnames that the site can run from. The setting needs to be an array of regular expression patterns, without delimiters, representing the hostnames you would like to allow to run from.

For example, if you are running your site from a single hostname "www.example.com", then you should add this to your settings (usually found at ./sites/default/settings.php):

$settings['trusted_host_patterns'] = array(

Note the ^, \., and $. These are PCRE Syntax. These just mean that you want to match "www.example.com" precisely, with nothing extra at the beginning and end, and that the dots should be treated as dots and not wildcard characters.

If you are running from "example.com", then just use:

$settings['trusted_host_patterns'] = array(

If you need to run a site of multiple domains and/or subdomains, and are not doing canonical URL redirection, then your setting would look something like this:

$settings['trusted_host_patterns'] = array(

This allows the site to run off of all variants of example.com and example.org, with all subdomains included.

Once you adjust $settings['trusted_host_patterns'] to the proper value, you should be able to browse to your site again.

You can also check on the status of your trusted host settings from the status report page, which is at admin/reports/status

If you remove the setting altogether, the trusted host mechanism will not be used, and you will see an error on the status report page. In addition, your site may also be vulnerable HTTP Host header attacks.

If you have this setting configured and are seeing this message, then it probably means you have messed up the regular expression syntax. In this case, take the first example, and copy/paste into your settings, and then edit it to reflect the hostname your site runs from.

  • 6
    I am one of the authors of the patch, and also wrote the original draft of the Change Record for the patch (which is where a lot of the text above comes from). This question and answer is to give the error message "high googlability" in case anyone encounters it. Please feel free to add your own answer if you think you can explain this setting better. We may also end up making this CW. – mpdonadio Jan 24 '15 at 15:02
  • There are a bazillion configs when the Drupal server is not accessible directly but is behind a reverse proxy and this is just a nuisance. There should be a clean opt-out mechanism. – user49 Jan 24 '15 at 18:17
  • I believe it is now, there were efforts to automatically set it in the installer, but that was removed again for now. No validation happens if you don't set it the trusted hostnames. Also, I only just now made the connection between mpdonadio and MPD :) – Berdir Jan 25 '15 at 20:27
  • Yeah, the auto-configuration was removed from the patch that was committed. It is currently "opt-in, but we will warn you if it isn't set". There is a followup, drupal.org/node/2404259, to set it in the installer. @Berdir, I had an internet identity crisis a while ago, and when I became a mod here I didn't want to change my nickname :) My git username if different, too... – mpdonadio Jan 25 '15 at 21:06
  • When I use '^theming\.dev$', I have this error: Error message UnexpectedValueException: Untrusted Host "localhost" in Symfony\Component\HttpFoundation\Request->getHost() (line 1221 of core/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Request.php). – Axel Briche Jan 28 '15 at 14:19

This happens because trusted_host_patterns variable in your settings file. If you're working on the local environment and you want to override this, define the following section in your settings.local.php file:

 * Drupal Trusted Host Patterns
$settings['trusted_host_patterns'] = [];

Or more generic pattern:

$settings['trusted_host_patterns'] = [ '.*' ];

Or more specific for the local environments:

$settings['trusted_host_patterns'] = array(

It's the simplest solution, but not recommended as you should set the proper values to avoid spoofing the HTTP Host header for nefarious purposes. If your website is running only on your local, then you should be fine.

See: New setting for trusted hostname configuration.

| improve this answer | |
  • 1
    You should have more upvotes for this answer because it defines the proper use of the settings.local.php file. These settings probably shouldn't be defined in settings.php, it defeats the purpose of having a different settings file for your local environment which can be turned on/off with 3 # characters. A link or some info on the local setup may earn more votes. – dimmech Jan 17 '18 at 16:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.