# Fix Vite “Blocked request. This host is not allowed” > Vite blocks unknown Host headers since 6.0.9, 5.4.12 and 4.5.6. Add your tunnel’s domain to server.allowedHosts, never true. Fixes for ngrok, Cloudflare, qURL. Source: https://layerv.ai/guides/fix-vite-blocked-request-host-not-allowed/ --- [← All guides](https://layerv.ai/guides/) # Fix Vite “Blocked request. This host is not allowed” Checked against the qURL™ CLI 3.4.1 source and documentation on October 9, 2026. Link and session behaviour is [tested separately](https://layerv.ai/research/qurl-behaviour/). Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide. ## Why does Vite say “Blocked request. This host is not allowed” when I open my app through a tunnel? Since Vite 6.0.9, 5.4.12 and 4.5.6, the dev server blocks Host headers it does not know, so requests through qURL, ngrok or a Cloudflare Quick Tunnel fail with “Blocked request”. Add that tool’s hostname to server.allowedHosts: .qurl.site for qURL, your ngrok dev domain for ngrok, .trycloudflare.com for Cloudflare. Restart Vite, and keep the host check on rather than setting allowedHosts to true. ## What you need - A Vite dev server (or vite preview) opened through a tunnel or proxy - Your vite.config.js or vite.config.ts ## Steps 1. ### Read the host from the error The page names the host Vite refused: “Blocked request. This host (“abc.trycloudflare.com”) is not allowed. To allow this host, add “abc.trycloudflare.com” to server.allowedHosts in vite.config.js.” If it says preview.allowedHosts, vite preview answered rather than the dev server. 2. ### qURL: allow .qurl.site A qURL link opens the app on a new subdomain of qurl.site, so add the domain with a leading dot: it allows qurl.site and every subdomain under it. Allow only the tool you use, and never a top-level domain such as .com. Leave off --host: qURL reaches the dev server on localhost. ``` // vite.config.js (merge into your existing config) export default { server: { allowedHosts: ['.qurl.site'], }, } ``` 3. ### ngrok: allow your dev domain ngrok assigns each account one dev domain on ngrok-free.app or ngrok-free.dev, and it stays the same between runs, so allow that exact hostname. Copy it from the Forwarding line ngrok prints, or from the Vite error. ``` // vite.config.js (merge into your existing config) export default { server: { allowedHosts: ['your-domain.ngrok-free.app'], }, } ``` 4. ### Cloudflare Quick Tunnel: allow .trycloudflare.com A Cloudflare Quick Tunnel gets a new random trycloudflare.com hostname each time cloudflared starts, so allow the domain with a leading dot rather than one hostname. ``` // vite.config.js (merge into your existing config) export default { server: { allowedHosts: ['.trycloudflare.com'], }, } ``` 5. ### Restart Vite Vite restarts itself when a config file it loaded changes. Restart it yourself if you just created the file, then reload the page through the tunnel. 6. ### For vite preview, nothing extra preview.allowedHosts defaults to server.allowedHosts, so one entry covers both. Set preview.allowedHosts only to give the preview server a different list; Vite 6.0.11 fixed a bug that ignored specific values there. ## What the recipient sees With the host allowed, the request reaches Vite and the page loads through the link. If the page loads but hot reload never connects, the tunnel is not carrying the WebSocket: see the hot reload guide. To send the running app to a client through qURL from here, the client review guide covers publishing, the link and ending access. ## Which tool should carry your Vite dev server? | Option | Choose it when | Trade-off | | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | [qURL](https://layerv.ai/cli/) | qURL fits when you want particular people to open the app running on your machine, with no account and no public URL. | With qURL your computer and the app must stay running, and each person needs a link or an invitation from you. | | [ngrok](https://layerv.ai/compare/qurl-vs-ngrok/) | ngrok fits when you need a stable public URL, for example for webhooks, or want ngrok’s OAuth or IP rules in front of the app. | ngrok needs an account and authtoken first, the URL is public, and free-plan browser visitors see a warning page. | | [Cloudflare Quick Tunnels](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) | A Cloudflare Quick Tunnel fits when you want a throwaway URL with no account, optionally behind an email PIN with --allowed-mail. | A Cloudflare Quick Tunnel is public unless you set --allowed-mail, gets a new hostname each run, and does not support Server-Sent Events. | | [Tailscale Funnel](https://layerv.ai/compare/qurl-vs-tailscale-funnel/) | Tailscale Funnel fits when the machine is already on a tailnet and you want a stable public HTTPS name for it. | Tailscale Funnel needs a tailnet, makes the app public on a ts.net hostname, and puts no access control on Funnel traffic. | ## Troubleshooting | If you see | Do this | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Still blocked after editing the config | Vite did not reload the file. Restart it, and check you edited the config it actually loads (vite.config.ts and vite.config.js can both exist). | | The error names preview.allowedHosts | You are running vite preview. Add the domain to server.allowedHosts, which preview inherits, or set preview.allowedHosts on Vite 6.0.11 or later. | | The page loads but edits don’t appear without a refresh | The hot reload WebSocket is not getting through. See the guide to hot reload through a tunnel. | ## Frequently Asked Questions Does this fix work on Vite 8? Yes. On October 18, 2026 we ran each configuration on this page against Vite 8.3.4 on macOS. With no allowedHosts, requests carrying a qurl.site, ngrok-free.app or trycloudflare.com Host header got 403 “Blocked request”. Each entry let in only its own tool’s hostnames, editing vite.config.js restarted the server by itself, and vite preview used the same list. Through a real qURL link, Vite 8.3.4 showed the error for its c-….qurl.site host until .qurl.site was added, then loaded and hot-reloaded. Can I set allowedHosts to true? You can, but Vite’s docs warn against it: true allows any website to send requests to your dev server through DNS rebinding attacks and download your source code and content. Use an explicit list of the domains you need. Why did this start happening? Vite 6.0.9, 5.4.12 and 4.5.6 added the host check to fix a DNS rebinding vulnerability (GHSA-vg6x-rcgg-rjx6). By default Vite allows localhost, subdomains of .localhost, and IP addresses; any other hostname, including a tunnel’s, must be listed. Which domain do I add for qURL? .qurl.site. A qURL link opens the app at an address like https://r\_….qurl.site/, and the leading dot covers every subdomain. Leave off --host: qURL reaches the dev server on localhost. Who else can reach my app while the link is open? Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive. ## Related Resources [Guide: Share a dev server with a client →](https://layerv.ai/guides/share-dev-server-with-client/) [Guide: Hot reload through a tunnel →](https://layerv.ai/guides/fix-hot-reload-through-a-tunnel/) [Vite docs: server.allowedHosts ↗](https://vite.dev/config/server-options) [Vite advisory GHSA-vg6x-rcgg-rjx6 ↗](https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6) ## Publish your app now Install the CLI, then run one command. No sign-up, no API key. [Install the CLI ↗](https://layerv.ai/cli/) --- *This markdown version is auto-generated from [https://layerv.ai/guides/fix-vite-blocked-request-host-not-allowed/](https://layerv.ai/guides/fix-vite-blocked-request-host-not-allowed/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*