Stop reflecting the Host header

host-header-poisoning

Your server copies the client's Host header into the response body. Use the validated host your proxy sets, not the raw value the client sent.

Your stack

CDN and edge

Cloudflare

Web servers

Nginx Apache

Frameworks

Express

Cloudflare

1 Cloudflare normalizes the Host header by default. If you see this finding, your origin server is likely exposed directly
2 Ensure all traffic goes through Cloudflare by blocking direct origin access

Nginx

1 Set the Host header to a fixed value using $host (validated) instead of $http_host (raw client input)
2 Add a default server block that rejects requests with unknown Host headers

nginx

# Use $host (validated by server_name) not $http_host (raw)
proxy_set_header Host $host;

# Default server block - reject unknown Host headers
server {
    listen 80 default_server;
    server_name _;
    return 444;
}

Nginx docs

Apache

1 Enable UseCanonicalName to ignore client-supplied Host headers for URL generation
2 Set ServerName explicitly in your virtual host configuration

apache

# Force Apache to use ServerName for self-referential URLs
UseCanonicalName On
ServerName www.example.com

Apache docs

Express

1 Validate req.headers.host against an allowlist of your known hostnames
2 Never use the Host header to build URLs. Use a hardcoded base URL from configuration instead

javascript

const ALLOWED_HOSTS = new Set(['example.com', 'www.example.com']);

app.use((req, res, next) => {
  const host = req.headers.host?.split(':')[0];
  if (!ALLOWED_HOSTS.has(host)) {
    return res.status(400).send('Invalid Host header');
  }
  next();
});

Does your app still have this?

Scan your domain