Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The “Access through untrusted domain” page means Nextcloud received a Host header that is not an exact entry in trusted_domains in config.php. Add the hostname (and a non-standard port) exactly as users enter it. For an existing Docker installation, change the live configuration with occ; changing NEXTCLOUD_TRUSTED_DOMAINS in Compose is normally an initial-setup operation and may not alter an already-created data volume.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
If a reverse proxy is involved, configure it separately in trusted_proxies and, when required, the overwrite settings for host, protocol, web root and command-line URL.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What the error means
Nextcloud compares the request’s Host header with the values in its trusted_domains array. The comparison is deliberately exact: a different subdomain, an IP address instead of a DNS name, or a port that was omitted can produce the warning even when the server is reachable.
For example, if people open https://cloud.example.com, the trusted-domain entry must be cloud.example.com. If they open https://cloud.example.com:8443 and that port is part of the URL they use, add cloud.example.com:8443. An internal container name or the reverse proxy’s private address does not belong in this list unless a browser actually uses that value as its hostname.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Quick fix for an existing Docker Compose installation
- Identify the exact hostname and port shown in the browser’s address bar when the error appears.
- List the current trusted-domain entries from the running container:
docker exec --user www-data nextcloud php occ config:system:get trusted_domainsReplace
nextcloudwith the actual container name if yours is different. - Add the missing value at an unused array index. For example:
docker exec --user www-data nextcloud php occ config:system:set trusted_domains 1 --value=cloud.example.com - Reload the page using the same URL. If the URL contains a non-standard port, use that host-and-port combination as the value.
Check the list before writing. Setting an index that already contains another domain replaces that entry; it does not append a new one.
Choose the right configuration method
| Situation | Recommended method | Why |
|---|---|---|
| Brand-new instance whose data volume has not been initialized | Set NEXTCLOUD_TRUSTED_DOMAINS in Compose before the first startup |
The official image reads this environment variable during initial setup. |
| Running instance with existing files and database | Use occ config:system:set trusted_domains |
It writes the live Nextcloud configuration without recreating the data volume. |
| Requests arrive through a reverse proxy | Configure trusted_proxies and the applicable overwrite settings, then add the public browser hostname to trusted_domains |
Proxy trust and browser-hostname trust solve different problems. |
Set trusted domains on the first Compose startup
For a new deployment, add a space-separated list to the Nextcloud service in docker-compose.yml (or the equivalent Compose file):
services:
nextcloud:
image: nextcloud
environment:
NEXTCLOUD_TRUSTED_DOMAINS: "cloud.example.com 203.0.113.50"This example allows both the DNS name and the documented IP address. Separate values with spaces, not commas. Include every public name that users will actually enter, such as a second DNS alias, but do not add arbitrary internal names.
Start the stack only after the variable is present. The image’s initialization process uses it while creating the initial configuration. If the instance has already been initialized, restarting after editing Compose may leave the old trusted_domains array unchanged. In that case, use occ against the live container instead of deleting data to force initialization again.
Adding several domains safely
Give each hostname its own array index when using occ. First inspect the existing numbering, then choose an unused index. For example, if index 0 is already occupied, write the next value at index 1. Repeat with the next free index for additional names. This avoids accidentally replacing the original entry.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Change the live configuration with occ
The occ command runs Nextcloud’s command-line administration tool inside the application container. The web process normally runs as www-data, so execute the command with that user:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsdocker exec --user www-data nextcloud php occ config:system:get trusted_domainsRead the output and record the indexes already in use. Then add or replace one index deliberately:
docker exec --user www-data nextcloud php occ config:system:set trusted_domains 1 --value=cloud.example.comRun the get command again to verify that the value was written. If you need an IP address as well, select another unused index and set it separately. Keep the public names users need; a long list of guessed aliases makes future troubleshooting harder and increases the number of accepted host headers.
Using a Compose service instead of a container name
Some installations address the service through Compose rather than a fixed container name. The equivalent form is:
docker compose exec --user www-data nextcloud php occ config:system:get trusted_domains
docker compose exec --user www-data nextcloud php occ config:system:set trusted_domains 1 --value=cloud.example.comUse the service name from your Compose file. If the command reports that the container or service cannot be found, inspect the running stack and substitute the actual application service name; do not run occ in the database or proxy container.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Find the hostname Nextcloud is actually receiving
Start with the URL in the address bar, including the port. Distinguish these common cases:
https://cloud.example.comrequirescloud.example.com.http://cloud.example.comstill uses the host namecloud.example.com; the protocol is handled separately.https://203.0.113.50requires the IP address if that is how users connect.https://cloud.example.com:8443requires the host-and-port form when that non-standard port is exposed to browsers.- A URL such as
https://www.example.com/nextcloudstill haswww.example.comas its hostname;/nextcloudis a path, not a trusted-domain value.
Do not infer the value from the Docker network name, container name, or an internal service address. Those are implementation details unless a client is genuinely connecting with them.
Reverse proxies require separate settings
A reverse proxy terminates or forwards the browser request before it reaches Nextcloud. Nextcloud must know which proxy IPs or networks are allowed to forward requests; these belong in trusted_proxies, not in trusted_domains merely because the proxy connects to the container.
The public hostname still goes in trusted_domains. The proxy’s address belongs in trusted_proxies only when it is the intermediary sending the request to Nextcloud. Adding a private proxy address as a trusted domain does not fix a browser request for a different public name.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When automatic detection produces the wrong canonical URL, Nextcloud provides overwrite settings for the externally visible values:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
overwritehostforces the host and, where applicable, port that should appear in generated URLs.overwriteprotocoltells Nextcloud whether the public connection is HTTP or HTTPS when TLS is terminated before the application.overwritewebrootspecifies a path prefix when Nextcloud is published below a subdirectory.overwrite.cli.urlsets the canonical base URL used by command-line jobs and generated links.
These settings address URL generation and proxy awareness; they do not replace the need for the exact browser hostname in trusted_domains. A proxy-header warning has also been discussed in the Nextcloud Docker issue tracker, so review forwarded-header handling when the domain is correct but requests are still interpreted as coming from an unexpected host.
Why editing docker-compose.yml may appear to do nothing
Community reports describe existing installations where changing NEXTCLOUD_TRUSTED_DOMAINS in the Compose file did not update the array. The practical explanation is that the variable is consumed during initial volume creation, while the live configuration is already stored in the persistent Nextcloud volume. Restarting the same volume therefore may not re-run that initialization step.
For an instance that contains data, users or an established database, use occ. Do not remove the volume simply to make the environment variable run again. Removing the Nextcloud volume can wipe the instance, depending on how storage is mapped and what your backup covers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBack up before making destructive changes
Before any operation that removes or recreates a volume, verify that you can restore both the files and the database. A practical checklist is:
- Confirm the location of the persistent Nextcloud data volume or bind mount.
- Create a current copy of the data and configuration, including
config.php. - Export the database using the database engine’s supported backup method.
- Record the Compose file, environment values, volume names and proxy configuration.
- Test that the backup is readable and that you know the restoration procedure.
There is rarely a reason to erase a working volume for this error: writing the correct array entry with occ is safer and preserves the existing installation.
Troubleshooting when the warning remains
| Symptom | Likely cause | Action |
|---|---|---|
| The error appears for one alias but not another | Only one hostname is in trusted_domains |
Add the failing browser hostname at a free index and verify it with config:system:get. |
| Compose shows the new variable, but Nextcloud still rejects the name | The persistent volume was initialized before the edit | Use occ on the running application container; keep the volume. |
| A new entry replaced an old one | An occupied array index was reused | Inspect the list, restore the displaced value at another index, then add the new value at a free index. |
| The proxy hostname is trusted, but the public URL is rejected | The browser uses a different public host | Trust the exact public host; configure the proxy address under trusted_proxies. |
| Links redirect to the wrong scheme, host or path | Proxy metadata is not reflected in overwrite settings | Review overwritehost, overwriteprotocol, overwritewebroot and overwrite.cli.url for the published URL. |
occ fails immediately |
Wrong container, wrong user or command run outside the application container | Run it in the Nextcloud application container as www-data, using the actual container or Compose service name. |
Validate the fix without changing more settings
- Run
config:system:get trusted_domainsand confirm the exact failing hostname is present. - Open the same scheme, hostname and port that produced the warning.
- Test each public alias separately; a successful DNS lookup does not prove that Nextcloud trusts the alias.
- If a proxy is present, confirm that requests are forwarded with the intended host and protocol and that the proxy itself is listed in
trusted_proxies. - Only after these checks consider URL overwrite settings or proxy configuration changes.
Security and maintenance considerations
trusted_domains is a host-header allowlist, not an authentication mechanism. A value should represent a name you control and intend to serve Nextcloud from. Avoid broad, speculative entries and do not treat the setting as permission to expose the service publicly without authentication, TLS and normal account security.
Keep a record of every accepted public name and its purpose. When retiring an alias, remove its array entry deliberately after confirming that no clients, mobile applications or scheduled jobs still use it. If a hostname changes, update DNS, the proxy’s public configuration and Nextcloud’s trusted-domain list as one change so users do not encounter intermittent failures.
Frequently asked questions
Does the port belong in trusted_domains?
Include the port when users reach Nextcloud through a non-standard port and that port is part of the browser URL. Use the exact host-and-port form shown to clients.
Can I fix an existing installation only by editing Compose?
Not reliably. The environment variable is used in practice during initial setup. For an initialized volume, write the live array with occ.
Should I add the reverse proxy’s IP as a trusted domain?
No, unless a browser actually uses that IP as its hostname. Configure proxy addresses in trusted_proxies and keep the public browser hostname in trusted_domains.
Is deleting the volume a valid solution?
It may force initialization, but it can erase the instance. Back up files, configuration and database first; for a running installation, use occ instead.
The Bottom Line
Add the exact browser hostname (and non-standard port) to trusted_domains. Use NEXTCLOUD_TRUSTED_DOMAINS before first initialization, or use occ for an existing volume. Configure reverse proxies under trusted_proxies and the overwrite settings, and never remove a persistent volume without a tested backup.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
