# django.core.exceptions.SuspiciousOperation: Invalid HTTP_HOST header

- **ID:** `python/django-suspiciousoperation`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The HTTP_HOST header in the request does not match ALLOWED_HOSTS setting.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **Add valid host to ALLOWED_HOSTS** (95% success)
   ```
   In settings.py: ALLOWED_HOSTS = ['example.com', 'www.example.com']
   ```
2. **Use environment variable for dynamic hosts** (90% success)
   ```
   ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
   ```

## Dead Ends

- **Setting ALLOWED_HOSTS to ['*']** — Security risk; open to host header attacks. (80% fail)
- **Ignoring the error** — Request will be rejected. (90% fail)