To put Django’s admin on admin.example.com, make every layer agree on that hostname: create DNS, add a proxy virtual host and TLS certificate, preserve the original Host and HTTPS scheme, allow the hostname in ALLOWED_HOSTS, and configure CSRF and cookie scope for the trust boundary you actually want. A mismatch at any layer causes familiar failures such as Invalid HTTP_HOST, CSRF 403 responses, redirect loops, missing login cookies, or an unstyled admin.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an extra admin domain changes
A separate admin hostname is usually a subdomain, for example admin.example.com, while the public application remains on www.example.com. Django is still one application unless you deliberately split deployments; the browser simply sends admin requests with a different host and possibly a different origin.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
That distinction affects four independent controls:
- DNS: the hostname must resolve to the load balancer or reverse proxy that serves the application.
- Proxy and TLS: the edge server must accept that hostname, present a certificate covering it, redirect HTTP to HTTPS, and forward the request correctly.
- Django host validation:
ALLOWED_HOSTSmust include the public admin hostname. - Browser security: CSRF origin checks and cookie scope must match whether the admin is same-origin, cross-origin, or intentionally sharing authentication with other subdomains.
Complete the layers in that order. Changing Django settings cannot make a nonexistent DNS record resolve, and changing DNS cannot fix a proxy that forwards the wrong host or scheme.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the hostname and trust boundary first
Use a subdomain when the sites belong to the same service
admin.example.com is operationally simpler than buying or configuring an unrelated registrable domain. One parent domain makes DNS management and certificate coverage easier to understand, while still allowing the admin to have its own host-only cookies and URL surface.
Do not assume that a sibling subdomain is harmless. If you later set a cookie for .example.com, browsers can send it to every matching subdomain. Any controlled or uncontrolled sibling then becomes relevant to the authentication trust boundary. Decide which hosts you operate and protect before choosing shared cookies.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDocument the intended browser origins
Write down the exact public URLs before configuring Django. For a TLS-only admin, that normally means https://admin.example.com. The scheme matters: http://admin.example.com and https://admin.example.com are different origins for CSRF purposes.
- Public site: the hostname users browse for the application.
- Admin site: the hostname users browse for Django admin.
- Any deliberately shared static or API host.
- Any host from which the browser will make unsafe cross-origin requests.
Keep this list narrow. It becomes the basis for ALLOWED_HOSTS, CSRF_TRUSTED_ORIGINS, certificate names, and proxy server blocks.
Create and verify DNS
Select the record type
Create an A and, when IPv6 is served, an AAAA record for the admin hostname pointing to the public load balancer or reverse proxy. If your provider gives you a canonical hostname, use a CNAME instead. The destination must be the edge service that already receives web traffic, not an internal Django socket or private address.
Confirm public resolution before debugging Django
Check the hostname from a network outside your private infrastructure. It should resolve to the expected edge endpoint, and the result should be consistent with how your proxy is addressed. If DNS returns an old address, a parking page, or no answer, stop there; Django has not received the request yet.
DNS changes can be cached according to the record’s TTL. During a migration, verify both the old and new paths and remove stale records only after the proxy and certificate are ready.
Configure the reverse proxy and certificate
Add a virtual host for the admin name
Create a dedicated virtual host or server block whose name matches admin.example.com. Configure the edge server to:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Accept the admin hostname on the public interface.
- Serve a certificate whose coverage includes that exact hostname.
- Redirect HTTP requests to the equivalent HTTPS URL.
- Proxy the request to the Django application.
- Preserve the public
Hostheader. - Forward the original client scheme, normally through
X-Forwarded-Proto: httpsafter TLS termination.
The application should see the same host the user entered, not an internal upstream name. Preserving the host is important for Django’s validation and for code that calls request.get_host() to construct links.
Choose where TLS terminates
| Architecture | What happens | Operational consequence |
|---|---|---|
| TLS terminates at the proxy | The proxy decrypts the public HTTPS request and forwards to Django, usually over an internal connection. | Certificate management and HTTPS redirects are centralized; Django must be configured to trust the proxy’s forwarded scheme header. |
| TLS passes through to the application | The proxy routes encrypted traffic onward and Django’s serving layer terminates TLS. | End-to-end termination remains available, but certificate and HTTPS handling are distributed across more components. |
Either design can work. The security-sensitive requirement is consistency: the proxy must send the header you configure, and clients must not be able to inject a trusted forwarded header directly.
Cover redirects and static assets
Make the certificate and HTTPS virtual host handle the admin hostname itself. A certificate valid only for www.example.com does not cover admin.example.com. Ensure proxy routes also allow the static-file paths used by the admin; a working HTML response with blocked CSS or JavaScript is a routing or certificate problem, not an admin-template problem.
Set Django’s host and proxy settings
Allow the exact public hosts
Django validates the incoming Host header against ALLOWED_HOSTS. Listing the admin name is both a routing prerequisite and a defense against Host-header attacks.
ALLOWED_HOSTS = ["www.example.com", "admin.example.com"]Use the names users actually request. A leading-dot entry such as .example.com matches the base domain and its subdomains, but it is appropriate only when every matching subdomain is under the same administrative control. A broad pattern can expose the application to hosts you did not intend to trust.
Tell Django when the proxy handled HTTPS
If the trusted proxy terminates TLS and sends the exact header/value pair shown below, configure Django to use it:
Free tools Windows power users keep installed
One-click scans. No signup required.
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")Use this setting only when the proxy is configured so an outside client cannot spoof X-Forwarded-Proto. If the proxy sends a different header or value, change the proxy and setting as a matched pair. Do not add the setting merely to silence a redirect loop.
When Django believes an HTTPS request was HTTP, it may generate HTTP redirects, mark security checks incorrectly, and reject otherwise valid CSRF requests. Correct the forwarded-scheme path instead of weakening security controls.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Keep host validation and proxy routing aligned
The proxy’s public server name, the forwarded Host, and the corresponding ALLOWED_HOSTS entry should all describe the same hostname. If the proxy forwards an internal name while the browser uses the admin name, Django will either reject the request or generate links for the wrong site.
Configure CSRF for the actual origin
Same-origin admin requests
When the login page and its POST are both loaded from https://admin.example.com, the browser’s origin and the HTTPS referer should identify that host. The proxy must preserve HTTPS so Django evaluates the request as secure.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Cross-origin requests
If JavaScript on one origin makes unsafe requests to another origin, add the exact destination origin to CSRF_TRUSTED_ORIGINS:
CSRF_TRUSTED_ORIGINS = ["https://admin.example.com"]Include the scheme and hostname. Do not add every subdomain by habit, and do not add an origin merely because it appears in DNS. Trust only origins that genuinely need to submit unsafe requests to this Django instance.
Diagnose origin failures by comparing three values
- The origin shown by the browser for the page making the request.
- The host Django receives after proxy forwarding.
- The scheme Django derives from the request and trusted proxy header.
A mismatch among those values explains most “Origin checking failed” and CSRF 403 responses after introducing an admin hostname.
Choose cookie scope deliberately
Host-only cookies: the safer default for an independent admin
Leave SESSION_COOKIE_DOMAIN and CSRF_COOKIE_DOMAIN unset when the admin should have its own browser credential boundary. The browser then scopes those cookies to the host that set them, reducing accidental exposure to sibling subdomains.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Parent-domain cookies: only for intentional shared login
Set a parent-domain cookie only when single sign-on across controlled subdomains is a deliberate requirement. A domain-wide cookie enlarges the trust boundary: every matching host can receive it, so a weakness on one sibling can affect sessions intended for another. Confirm that all covered subdomains are operated and secured by the same team before choosing this design.
| Cookie strategy | Useful when | Security boundary |
|---|---|---|
| Host-only cookies | The admin is independently authenticated or should remain isolated from the public site. | Narrower; cookies are sent only to the host that set them. |
| Parent-domain cookies | Controlled subdomains must share one login session. | Wider; matching sibling subdomains can receive the cookie. |
Also inspect the cookie’s Secure and SameSite attributes when troubleshooting. A browser will not send a Secure cookie over HTTP, and moving between hostnames can expose assumptions in an existing SameSite policy.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Decide whether host-aware URL routing is necessary
One URLconf for both hosts
If the public site and admin can use the same URL patterns and middleware, keep a single URLconf. Django’s built-in admin remains at its configured path, while the proxy exposes it through the separate hostname. This has the smallest maintenance surface.
Different URL sets by hostname
Use host-aware middleware or per-request URLconf selection when the admin and public host require genuinely different URL behavior. A separate URLconf module can prevent public routes from being available on the admin host and can make host-specific reverse lookups easier to reason about.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Routing choice | Strength | Cost |
|---|---|---|
| Single URLconf | Fewer modules and less duplicated route maintenance. | Host separation is handled mainly at the proxy and application settings layers. |
| Host-specific URLconf | Explicitly isolates route sets and behavior by hostname. | Requires host-selection logic and additional URLconf maintenance. |
Do not introduce host-aware routing solely because the browser uses a subdomain. Add it when the routes or behavior actually differ.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check static files and generated links
Serve admin assets over a trusted HTTPS path
Inspect the CSS and JavaScript requests made by the admin page. They should use the same HTTPS hostname or a static host that you intentionally trust and have covered by its own certificate and proxy rules. Mixed-content blocking or a static route that exists only on www.example.com can make the admin appear broken even though its HTML loaded.
Test absolute URLs
Review redirects, password-reset links, email links, and any code that builds an absolute URL from request.get_host(). They should point to the intended public hostname. A preserved host header is necessary, but application code that hard-codes the public site can still send administrators to the wrong host.
Apply a minimal settings baseline
For the common arrangement of a public site and a TLS-terminated admin subdomain, the relevant settings are:
ALLOWED_HOSTS = ["www.example.com", "admin.example.com"]
CSRF_TRUSTED_ORIGINS = ["https://admin.example.com"]
# Only when the trusted proxy sets this exact header/value pair:
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
# Leave unset for host-only cookies unless shared authentication is intentional.
# SESSION_COOKIE_DOMAIN = ...
# CSRF_COOKIE_DOMAIN = ...The CSRF entry is useful when the browser performs an unsafe cross-origin request involving the admin origin. If all requests are same-origin, do not broaden the list unnecessarily. The proxy header setting is conditional, not universal.
Verify the deployment in a controlled order
Run these checks after DNS, proxy, and Django configuration are deployed. They validate behavior; they are not substitutes for reviewing your proxy’s access controls.
- DNS: resolve
admin.example.comfrom an external network and confirm it reaches the intended edge service. - HTTP redirect: request the HTTP form of the admin URL and confirm it redirects to the equivalent HTTPS URL without changing the hostname or path.
- Certificate and login: open the HTTPS admin URL, verify the certificate name, load the login page, and sign in.
- CSRF POST: submit a form that exercises CSRF protection, such as the admin login or another state-changing action, and confirm it succeeds from the intended origin.
- Invalid host: send a request with a hostname that is not authorized and confirm Django or the edge layer rejects it rather than serving the application.
- Forwarded scheme: inspect a request that traveled through the TLS-terminating proxy and confirm Django sees HTTPS through the configured header pair.
- Assets and links: check browser developer tools for failed CSS or JavaScript requests, then exercise redirects and password-reset links to ensure they use the admin hostname where intended.
Troubleshoot common failures
“Invalid HTTP_HOST header”
First compare the browser’s hostname with ALLOWED_HOSTS. If the exact admin name is absent, add it. If it is present, inspect the proxy: it may be forwarding an internal or stale host. Also verify that an untrusted Host header is not reaching Django directly through an alternate listener.
“Origin checking failed” or a CSRF 403 on login
Compare the browser origin, forwarded scheme, and Django’s perceived host. Confirm the page was loaded over the same HTTPS origin used for the POST. If the request is genuinely cross-origin, add that exact HTTPS origin to CSRF_TRUSTED_ORIGINS; do not solve an origin mismatch by trusting every subdomain.
Redirect loop between HTTP and HTTPS
This usually means the proxy terminates TLS but Django does not know the client used HTTPS. Check that the proxy sends the expected X-Forwarded-Proto value and that SECURE_PROXY_SSL_HEADER matches it exactly. Also ensure clients cannot submit that header directly. Fix the pair before disabling redirects or other security settings.
Login succeeds, then returns to the login page
Inspect the response cookie’s domain, Secure and SameSite attributes, and the hostname used after login. A browser switching between the public and admin hosts may not send a host-only cookie to both. If shared authentication is required, deliberately use a parent-domain cookie only across controlled hosts; otherwise keep the admin session host-scoped and make all post-login redirects stay on that host.
Admin HTML loads without styling
Look at the failed asset requests. Check STATIC_URL, proxy routes for static paths, certificate coverage on the asset host, and browser mixed-content errors. The admin’s HTML response does not prove that its CSS and JavaScript paths are reachable over HTTPS.
Architecture choices that affect future maintenance
Same parent domain versus unrelated domain
A sibling subdomain generally reduces DNS and certificate complexity and makes the relationship between hosts explicit. An unrelated domain can create a stronger visual separation, but it requires a separate DNS and certificate relationship and makes cookie sharing impossible through a common parent domain. Choose based on the trust boundary, not branding alone.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Host-only versus shared authentication
Host-only cookies make the admin boundary easier to audit. Shared parent-domain cookies remove repeated logins across controlled subdomains but increase the consequences of a compromise on any one of them. Treat this as a security decision, not a convenience toggle.
Centralized TLS versus TLS pass-through
Centralized termination simplifies certificate renewal and edge redirects, provided forwarded-scheme handling is locked down. Pass-through preserves another layer of end-to-end termination but distributes certificate and HTTPS responsibilities. Document which component is authoritative so a future proxy change does not silently invalidate Django’s HTTPS assumptions.
What must remain consistent
The setup is complete only when the same admin hostname is represented consistently in DNS, the certificate, the proxy’s virtual host, the forwarded Host, ALLOWED_HOSTS, CSRF origin policy, cookie decisions, static routes, and generated links. When one layer disagrees, diagnose that layer directly instead of adding broader host or CSRF wildcards. Narrow, explicit settings are easier to test and keep the admin’s trust boundary understandable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
