1

I got the trusted host settings error.

The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure this. See Protecting against HTTP HOST Header attacks for more information.

I read the Trusted Host Settings documentation but I'm not understanding some of the basic context.

  • Are the "trusted hosts" me and other administrators who want to be able to administer the site remotely?
  • If so, would I add my PC's domain to the trusted host list?
  • Is this an error? Or is this a warning? – leymannx May 22 at 19:54
  • @leymannx I believe it said error, oddly. Should have included a screenshot before I corrected it. – glenviewjeff May 23 at 1:10
  • @leymannx yes, just restored a backup for a different reason and it does fall under the "Errors found" heading. – glenviewjeff May 26 at 18:27
  • @leymannx no, that question is for someone who can't see their site and gets an error with mal-configured trusted-host-patterns. My question is about what "trusted host" means. I specifically asked for "some of the basic context." And I didn't see a plain-English answer mentioning what trusted host means, only detailed explanation about the motivation for its implementation, echoing what I'd linked to in the documentation I'd already read. – glenviewjeff 2 days ago
4

Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, the trusted host regular expression would be ^www\.thedrupaldude\.com.

| improve this answer | |
  • Understanding trusted hosts also is about understanding the actual pattern you need to enter. Pay attention for the punctuation. See drupal.stackexchange.com/q/145286/15055 – leymannx 2 days ago
  • 1
    Yes, since it's a regular expression, you cannot simply put 'www.example.com', but it needs to be changed to '^www\.example\.com', for example. – kiamlaluno 2 days ago
  • Thanks, corrected. Happened to work anyhow of course because of regular expressions. – glenviewjeff 2 days ago

Not the answer you're looking for? Browse other questions tagged or ask your own question.