Fixing "Blocked request. This host is not allowed" in Strapi 5

Strapi 5 admin panels can show a “host not allowed” blank page when accessed through custom domains, tunnels, or proxies during `strapi develop`, because Vite’s development server validates Host headers to protect against DNS-rebinding attacks and normally permits only localhost addresses. Current Strapi 5 releases may already resolve the issue by setting permissive Vite host handling, so upgrading is recommended before changing configuration. For older versions or stricter security, a Vite configuration file should be created under `src/admin/` and use `mergeConfig` to add an explicit `server.allowedHosts` list, with exact domains or dot-prefixed domain patterns preferred over disabling checks with `true` or `all`. The issue applies only to development mode; publicly deployed Strapi instances should instead use a production build and start process, which avoids the Vite dev server and its performance, security, and deployment drawbacks. Tunnel setups that rewrite ports may also affect hot module reloading, though adding Vite’s `hmr.clientPort` should be tested carefully because recent Strapi versions may already handle websocket connections through the application server.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.