How to Set Up Trusted Proxies in Home Assistant

Why Home Assistant needs this

When a request travels through a reverse proxy, the proxy tells Home Assistant who the original visitor was in the X-Forwarded-For header. Anyone can write that header, so Home Assistant only accepts it from addresses you have explicitly listed as trusted proxies. A request that carries the header from anywhere else is rejected with 400: Bad Request, and Home Assistant writes one of these lines to its log:

A request from a reverse proxy was received from 172.30.32.1, but your HTTP integration is not set-up for reverse proxies
Received X-Forwarded-For header from an untrusted proxy 172.30.32.1

The Pluggie app forwards every request with the visitor's address in that header, so Home Assistant has to trust it once. The address shown in the log line is the one Home Assistant sees for Pluggie — useful if you are not sure what to enter below.

Which address to trust

Your setup	Trusted proxy to add
Home Assistant OS or Supervised, with the Pluggie app	172.30.32.0/23
Home Assistant Container or Core, with the Pluggie Docker container	The address of the Pluggie container as Home Assistant sees it — the IP from the log line above

172.30.32.0/23 is the internal network Home Assistant uses for all apps. It also covers other apps that act as a proxy, such as NGINX Proxy Manager or Cloudflared, so you can use the same entry for all of them.

Home Assistant 2026.8 or newer

Since 2026.8, the HTTP settings are in the user interface instead of configuration.yaml.

Home Assistant older than 2026.8

Add this to configuration.yaml and restart Home Assistant. If you already have an http: section, add the two keys to it instead of creating a second one.

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.32.0/23  # Pluggie app

Pluggie Docker container with Home Assistant Container

The steps are the same. Only the address is different: instead of 172.30.32.0/23, trust the address that Home Assistant sees for the Pluggie container. The easiest way to find it is the log line from the beginning of this guide — open your Pluggie address once, then look for "untrusted proxy" or "not set-up for reverse proxies" in the Home Assistant log. If both containers run on the same machine, it is usually a Docker network address such as 172.17.0.5. If Pluggie runs on a different machine, it is that machine's LAN address.

A single address can be entered as it is, or as 172.17.0.5/32.

Common mistakes

• A host address with a network mask. 172.30.32.1/23 is not a valid network. Use the network address 172.30.32.0/23, or a single address without a mask.
• Replacing existing entries. If another proxy is already listed, removing it breaks that proxy. Add Pluggie next to it.
• Trusting everything. Entering 0.0.0.0/0 or your whole home network makes the error go away, but then any device on that network can claim to be any IP address — and IP banning can be bypassed. Trust only the address Pluggie actually uses.
• Not confirming after the restart. Home Assistant silently reverts unconfirmed settings after 5 minutes, and the 400 error comes back.

Locked out?

If Home Assistant becomes unreachable after a change, do not confirm it — the previous settings return after 5 minutes. You can always reach Home Assistant from your home network on its local address, because the trusted proxy setting only affects requests that come through a proxy. As a last resort, the HTTP server settings are stored in .storage/http in your configuration folder; edit that file only while Home Assistant is stopped.

What you get afterwards

With the trusted proxy in place and Pluggie 0.7.0 or newer, Home Assistant sees the real IP address of every visitor. Failed login notifications show who actually tried, and you can safely turn on IP banning in the same HTTP server settings. Read more in Home Assistant Now Sees the Real IP Address of Every Visitor.