I have a django app hosted on a linode VM, proxied by nginx on that same VM.

In my nginx config I have a block to deny bad host header requests:

## Deny illegal Host headers
if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
    return 444;

This blocks almost all the bad requests, but I'm still getting occasional requests from a random linode host (the app sends me an email due to this host not being in the ALLOWED_HOSTS whitelist). Why are those requests able to get past nginx?

1 Answer 1


$host will be set to $server_name if the client does not provide a Host header value in the request. You should use $http_host to access the pure Host header.

See this document for details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .