Fix Vite “Blocked request. This host is not allowed”

Checked against the qURL™ CLI 3.4.1 source and documentation on October 9, 2026. Link and session behaviour is tested separately.

Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide.

Why does Vite say “Blocked request. This host is not allowed” when I open my app through a tunnel?

Since Vite 6.0.9, 5.4.12 and 4.5.6, the dev server blocks Host headers it does not know, so requests through qURL, ngrok or a Cloudflare Quick Tunnel fail with “Blocked request”. Add that tool’s hostname to server.allowedHosts: .qurl.site for qURL, your ngrok dev domain for ngrok, .trycloudflare.com for Cloudflare. Restart Vite, and keep the host check on rather than setting allowedHosts to true.

What you need

• A Vite dev server (or vite preview) opened through a tunnel or proxy
• Your vite.config.js or vite.config.ts

Steps

1. Read the host from the error

   The page names the host Vite refused: “Blocked request. This host (“abc.trycloudflare.com”) is not allowed. To allow this host, add “abc.trycloudflare.com” to server.allowedHosts in vite.config.js.” If it says preview.allowedHosts, vite preview answered rather than the dev server.

2. qURL: allow .qurl.site

   A qURL link opens the app on a new subdomain of qurl.site, so add the domain with a leading dot: it allows qurl.site and every subdomain under it. Allow only the tool you use, and never a top-level domain such as .com. Leave off --host: qURL reaches the dev server on localhost.

   // vite.config.js (merge into your existing config)
   export default {
     server: {
       allowedHosts: ['.qurl.site'],
     },
   }

3. ngrok: allow your dev domain

   ngrok assigns each account one dev domain on ngrok-free.app or ngrok-free.dev, and it stays the same between runs, so allow that exact hostname. Copy it from the Forwarding line ngrok prints, or from the Vite error.

   // vite.config.js (merge into your existing config)
   export default {
     server: {
       allowedHosts: ['your-domain.ngrok-free.app'],
     },
   }

4. Cloudflare Quick Tunnel: allow .trycloudflare.com

   A Cloudflare Quick Tunnel gets a new random trycloudflare.com hostname each time cloudflared starts, so allow the domain with a leading dot rather than one hostname.

   // vite.config.js (merge into your existing config)
   export default {
     server: {
       allowedHosts: ['.trycloudflare.com'],
     },
   }

5. Restart Vite

   Vite restarts itself when a config file it loaded changes. Restart it yourself if you just created the file, then reload the page through the tunnel.

6. For vite preview, nothing extra

   preview.allowedHosts defaults to server.allowedHosts, so one entry covers both. Set preview.allowedHosts only to give the preview server a different list; Vite 6.0.11 fixed a bug that ignored specific values there.

What the recipient sees

With the host allowed, the request reaches Vite and the page loads through the link. If the page loads but hot reload never connects, the tunnel is not carrying the WebSocket: see the hot reload guide. To send the running app to a client through qURL from here, the client review guide covers publishing, the link and ending access.

Which tool should carry your Vite dev server?

Troubleshooting

Frequently Asked Questions