# Unable to restrict allowed WOPI hosts

**URL:** <https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611>\
**Category:** Installation & Configuration\
**Created:** [May 13, 2024, 7:42pm UTC](https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611 "2024-05-13T19:42:55Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ash](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@ash](https://forum.collaboraonline.com/u/ash)\
**Post date:** [May 15, 2024, 9:33am UTC](https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611/3 "2024-05-15T09:33:58Z")

</div>

> [@Bevan](#):
>
> So, the way to secure this kind of installation is still to use the pattern from my original post (of course with the correct hostname of the machine). But for proper testing, one needs a different WOPI host (e.g., a second Nextcloud) on a separate machine.

Hi @Bevan!

Yes, this is correct. You can generate a different WOPI hostname and see from the logs (at least information level, if not debug) that it gets blocked without attempting to communicate with it. This test hostname doesn’t need to be real or (if it is) owned by you, it just has to be excluded from the config.

Feel free to report back if you uncover any issues.

Thanks!

---

_[View the full topic](https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611)._