I got the trusted host settings error.

The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure this. See Protecting against HTTP HOST Header attacks for more information.

I read the Trusted Host Settings documentation but I'm not understanding some of the basic context.

  • Are the "trusted hosts" me and other administrators who want to be able to administer the site remotely?
  • If so, would I add my PC's domain to the trusted host list?
  • Is this an error? Or is this a warning? – leymannx May 22 '20 at 19:54
  • @leymannx I believe it said error, oddly. Should have included a screenshot before I corrected it. – glenviewjeff May 23 '20 at 1:10
  • @leymannx yes, just restored a backup for a different reason and it does fall under the "Errors found" heading. – glenviewjeff May 26 '20 at 18:27
  • @leymannx no, that question is for someone who can't see their site and gets an error with mal-configured trusted-host-patterns. My question is about what "trusted host" means. I specifically asked for "some of the basic context." And I didn't see a plain-English answer mentioning what trusted host means, only detailed explanation about the motivation for its implementation, echoing what I'd linked to in the documentation I'd already read. – glenviewjeff May 31 '20 at 20:42

Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, the trusted host regular expression would be ^www\.thedrupaldude\.com.

  • Understanding trusted hosts also is about understanding the actual pattern you need to enter. Pay attention for the punctuation. See drupal.stackexchange.com/q/145286/15055 – leymannx May 31 '20 at 20:12
  • 1
    Yes, since it's a regular expression, you cannot simply put 'www.example.com', but it needs to be changed to '^www\.example\.com', for example. – kiamlaluno May 31 '20 at 20:41
  • Thanks, corrected. Happened to work anyhow of course because of regular expressions. – glenviewjeff May 31 '20 at 20:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.