To put Django Admin on admin.example.com, make every layer agree on that hostname: publish DNS, route the host through your TLS-terminating proxy, preserve the original Host and HTTPS scheme, allow the host in ALLOWED_HOSTS, and configure CSRF and cookies for your trust boundary. Only add host-specific URL routing when the admin needs a URL set different from the public site.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the domain design before changing Django
A subdomain such as admin.example.com is normally simpler than registering an unrelated domain. You can use the same DNS provider, obtain a certificate for a name under the domain you already control, and keep deployment and monitoring in one place. The trade-off is that sibling subdomains can become part of the same browser trust boundary if you share cookies or permit cross-origin requests.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
An unrelated hostname can provide stronger separation in some architectures, but it requires separate DNS, certificate coverage, redirects, password-reset links, and operational ownership. Decide whether users should authenticate independently on the admin host or receive single sign-on from the public host before you set cookie domains.
| Decision | Simpler option | Isolation-oriented option | Security consequence |
|---|---|---|---|
| Admin hostname | Subdomain such as admin.example.com |
Separate registrable domain | A parent-domain subdomain is easier to operate, but sibling hosts deserve careful cookie and trust-boundary review. |
| URL routing | One URLconf for the project | Host-aware URLconf selected per request | One URLconf reduces maintenance; separate URLconfs can prevent public routes from being exposed on the admin host. |
| Cookies | Host-only cookies (leave domain settings unset) | Parent-domain cookies for deliberate single sign-on | Host-only cookies limit where a stolen cookie can be replayed; parent-domain cookies are available to every matching subdomain. |
| TLS | TLS terminates at a trusted reverse proxy | TLS passes through to Django or an internal TLS proxy | Central termination is easier to manage; pass-through may be required by an end-to-end termination policy. |
Prerequisites and the request path
Before editing settings, identify the complete path for an admin request:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- The browser requests
https://admin.example.com. - Public DNS resolves that name to the load balancer or reverse proxy.
- The proxy selects a virtual host, presents a certificate covering the name, and forwards the request to Django.
- Django receives the original public
Hostand a trustworthy indication that the client used HTTPS. - Django validates the host, sets or reads cookies, performs CSRF checks, and builds redirects and absolute URLs.
If any layer uses a different name or scheme, the result can be an invalid-host error, a redirect loop, a failed CSRF check, a login that appears not to persist, or an unstyled admin page.
Have control of the DNS zone, the proxy configuration, and a certificate authority or certificate-management service. Confirm which proxy header carries the original scheme and ensure clients cannot inject that header directly.
Step 1: Create and verify DNS
- Choose the exact public name, for example
admin.example.com. Keep the spelling and capitalization consistent in documentation, proxy configuration, and Django settings. - Create an
AorAAAArecord when the hostname should resolve directly to the proxy’s IPv4 or IPv6 address. Use aCNAMEwhen your DNS design points the name at a provider-managed endpoint. - Wait for the record to become visible from the networks where administrators will connect. DNS propagation and a low time-to-live do not bypass cached records that already exist.
- Verify resolution before diagnosing Django. For example, run
dig +short admin.example.comor inspect the record with the DNS provider’s tools. The answer should identify the intended load balancer or proxy, not an old server.
Do not point the name at Django’s private application address unless that address is intentionally public and protected. A public proxy gives you a place to enforce HTTPS, rate limits, access controls, and a certificate.
Step 2: Add the proxy virtual host and certificate
Create a server block or virtual host for the new name. Obtain a certificate whose subject or SAN covers admin.example.com; a certificate for only www.example.com will not validate for the admin host. Redirect plain HTTP to HTTPS, then proxy HTTPS requests to the Django application.
The essential proxy behavior is independent of the proxy product:
- Preserve the public
Hostheader instead of replacing it with an internal service name. - Forward the original scheme in the header your Django setting expects, commonly
X-Forwarded-Proto: https. - Ensure the proxy, not an untrusted client, controls that forwarded header.
- Forward the request path and query string unchanged unless your application intentionally uses a prefix.
- Serve or proxy static assets over HTTPS on a host covered by a certificate.
A conceptual Nginx-style configuration looks like this; adapt directives to your proxy and upstream layout:
Recommended Free Tools
server {
listen 80;
server_name admin.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name admin.example.com;
# certificate and key directives go here
location / {
proxy_pass http://django_upstream;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}The example is intentionally limited to the behaviors Django needs. Your proxy may use a different syntax, and an upstream load balancer might already set forwarding headers. Do not configure Django to trust a header that your infrastructure does not set and sanitize.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Step 3: Allow the admin host in Django
ALLOWED_HOSTS is both a routing prerequisite and a Host-header defense. Add the exact public names users should be able to request:
ALLOWED_HOSTS = [
"www.example.com",
"admin.example.com",
]Django compares the incoming Host value against this list. A leading-dot entry such as .example.com matches the base domain and its subdomains. Use that pattern only when every matching subdomain is controlled and intended to reach this Django deployment; it is not a safe shortcut for an environment containing unrelated tenants.
Keep internal upstream names out of the public list unless clients genuinely send those names. If the proxy forwards the wrong Host, adding more entries can hide a routing error rather than fix it. Correct the proxy so Django sees the name in the browser’s address bar.
Step 4: Make Django understand HTTPS behind the proxy
When TLS terminates at the proxy, the connection from the proxy to Django may be plain HTTP even though the browser used HTTPS. Configure SECURE_PROXY_SSL_HEADER only when the trusted proxy sets the exact header/value pair and prevents clients from spoofing it:
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")This setting tells Django which request metadata represents the original scheme. A mismatch produces symptoms that look unrelated: Django may redirect an already-secure request back to HTTPS, generate insecure absolute URLs, or reject a CSRF referer because it believes the request is HTTP.
If TLS is passed through to Django, or if your proxy uses a different controlled header, use the configuration that matches that design instead of copying this example. Never weaken HTTPS or CSRF checks to work around a forwarding mismatch.
Step 5: Configure CSRF for the actual origin
CSRF validation is origin-sensitive. For a form submitted from https://admin.example.com to that same host, the browser’s origin and referer must agree with Django’s perceived host and scheme. An ordinary same-origin admin login does not require trusting every subdomain.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
If the admin makes an unsafe request across origins—for example, a page on another host posts to the admin endpoint—allow the precise HTTPS origin:
CSRF_TRUSTED_ORIGINS = [
"https://admin.example.com",
]Include a scheme; admin.example.com by itself is not an origin. Do not add a wildcard or every sibling subdomain by habit. Each trusted origin can submit state-changing requests, so list only hosts that genuinely need that relationship. Recheck this setting whenever an endpoint moves between the public and admin hosts.
Step 6: Choose a cookie boundary
Host-only cookies for independent admin authentication
Leave SESSION_COOKIE_DOMAIN and CSRF_COOKIE_DOMAIN unset when the admin should have a session limited to admin.example.com. The browser then does not send those cookies to www.example.com or other sibling hosts. Administrators may need to sign in separately, but compromise of another subdomain is less likely to expose the admin session.
Parent-domain cookies for deliberate single sign-on
Set a parent-domain cookie only when shared authentication across controlled hosts is an explicit requirement. A cookie scoped to .example.com is sent to the base domain and matching subdomains, so every such host becomes part of the credential trust boundary. Review all applications under that domain before enabling it, and use Secure and appropriate SameSite attributes for your deployment.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDiagnose a session that disappears
When login succeeds and immediately returns to the login page, inspect the browser’s cookie storage. Check the cookie domain, Secure flag, SameSite behavior, expiration, and the exact hostname used before and after authentication. Switching between www.example.com and admin.example.com with host-only cookies creates two separate sessions by design.
Step 7: Decide whether host-aware URL routing is needed
A single project can serve the admin and public site from one URLconf. This is the easiest arrangement when the admin lives at a conventional path such as /admin/ and both hosts share the same route set.
Use host-aware routing when the admin host must expose a different set of URLs, middleware assumptions, or a separate root route. Django’s deployment pattern is to select a URLconf per request, commonly through middleware that examines request.get_host() or through per-request URLconf selection. Keep the mapping explicit:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Map
admin.example.comonly to the admin URLconf. - Map
www.example.comonly to the public URLconf. - Define behavior for an unexpected but otherwise allowed host; do not silently fall back to the admin routes.
- Test reversing URLs in each host context, because a route name may exist in one URLconf and not the other.
Host routing does not replace ALLOWED_HOSTS. Validate the host first, then select routes. If both hosts intentionally share the same URLconf, avoid adding middleware solely for the sake of having separate domains.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Step 8: Check static files and absolute URLs
Django Admin requires its CSS and JavaScript to load from a secure, reachable origin. Verify that STATIC_URL, your proxy’s static route, and any static asset host all resolve through HTTPS. A page can render HTML while appearing broken if the browser blocks mixed-content asset requests.
Exercise every place that creates an absolute URL:
- Password-reset and invitation links should use the intended admin hostname when they lead to admin authentication.
- Code using
request.get_host()should receive the public host preserved by the proxy. - Redirects after login and logout should not switch between the public and admin names unless that transition is deliberate.
- Webhooks, allowed-origin checks, and Content Security Policy entries should include only the hosts that are actually used.
Minimal settings example
This is a starting point for an admin subdomain behind a trusted TLS-terminating proxy:
ALLOWED_HOSTS = ["www.example.com", "admin.example.com"]
# Add only when an unsafe request genuinely crosses origins.
CSRF_TRUSTED_ORIGINS = ["https://admin.example.com"]
# Use only when this exact header/value pair is set by a trusted proxy.
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
# Keep both settings unset for host-only cookies unless shared login is intentional.
# SESSION_COOKIE_DOMAIN = ...
# CSRF_COOKIE_DOMAIN = ...Whether CSRF_TRUSTED_ORIGINS is needed depends on the request origin and your deployment flow. Do not copy it as a blanket permission for every subdomain.
Verification checklist
Run these checks after DNS, proxy, certificate, and settings changes have reached the environment:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Test | Expected result | If it fails |
|---|---|---|
Resolve admin.example.com |
The intended load balancer or proxy address is returned. | Fix DNS or wait for the authoritative record to update before changing Django. |
Request http://admin.example.com |
A redirect leads to the HTTPS URL. | Inspect the HTTP virtual host and redirect rule. |
| Open the HTTPS login page | The certificate is valid for the admin name and the page loads. | Check certificate coverage, SNI, proxy routing, and upstream health. |
| Submit a login POST | The request passes CSRF checks and the authenticated session persists. | Compare origin, forwarded scheme, cookie attributes, and host names. |
| Send a request with an unapproved Host | Django rejects it rather than serving the application. | Review ALLOWED_HOSTS and whether the proxy is exposing an unintended listener. |
| Inspect a proxied request | Django sees the public Host and the correct HTTPS scheme. | Correct header forwarding and SECURE_PROXY_SSL_HEADER together. |
| Load an admin page with browser developer tools open | CSS and JavaScript requests return successfully over HTTPS. | Inspect STATIC_URL, static proxy routes, certificate coverage, and mixed-content errors. |
These tests should be performed in the deployed environment; a local development success does not prove that DNS, TLS, and forwarding headers are correct in production.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting by symptom
“Invalid HTTP_HOST header”
The admin name is missing from ALLOWED_HOSTS, the proxy is forwarding an internal or stale Host value, or an untrusted Host is reaching Django directly. Confirm the browser URL, inspect the request received by Django, and correct the proxy before broadening the allow-list.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
“Origin checking failed” or a CSRF 403
Compare three values: the browser’s origin, the forwarded scheme, and Django’s perceived host. If the request is genuinely cross-origin, add the exact HTTPS origin to CSRF_TRUSTED_ORIGINS. If it is same-origin, investigate a wrong Host header, an HTTP-versus-HTTPS mismatch, or a stale CSRF cookie instead of adding broad trust.
Redirect loop
Django usually does not know that the client used HTTPS because the proxy is not forwarding the scheme or Django is not trusting the controlled header. Make the proxy/header pair consistent. Do not disable secure redirects to conceal the problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Login succeeds, then the login page returns
Check whether the response sets a cookie for the host the browser is using, whether the Secure and SameSite attributes permit it, and whether a redirect changes the hostname. Host-only cookies intentionally do not follow a user between the public and admin hosts; parent-domain cookies should be introduced only after reviewing every controlled sibling host.
Admin HTML loads without styling
Inspect failed CSS and JavaScript requests. Common causes are a static route that exists only on the public virtual host, a certificate that does not cover the asset host, an incorrect STATIC_URL, or mixed-content blocking caused by an HTTP asset URL.
Only some redirects use the wrong hostname
Search for hard-coded domain names and code that builds URLs from an untrusted or internal request value. Ensure the proxy preserves the public Host and that application code uses the intended canonical host for password resets, redirects, and email links.
Security decisions to document
- Which exact hostnames are controlled and listed in
ALLOWED_HOSTS. - Which proxy sets
X-Forwarded-Proto(or another scheme header), and how direct client spoofing is prevented. - Whether admin and public sessions are independent or intentionally shared.
- Which origins, if any, are in
CSRF_TRUSTED_ORIGINSand why each is required. - Whether the proxy or Django terminates TLS, and where certificates are renewed.
- Which URLconf is selected for each host and what happens for an unexpected host.
Keeping these choices explicit prevents a later subdomain, proxy migration, or cookie change from silently expanding the admin’s trust boundary.
Quick Recap
Final deployment sequence
- Choose
admin.example.comand decide whether its login is independent. - Publish and verify DNS.
- Add the HTTPS virtual host, certificate, HTTP-to-HTTPS redirect, and Django upstream.
- Preserve the public Host and forward a trustworthy HTTPS scheme.
- Add the exact name to
ALLOWED_HOSTS. - Configure
SECURE_PROXY_SSL_HEADERonly for the controlled header your proxy actually sends. - Add an exact CSRF trusted origin only for required cross-origin unsafe requests.
- Leave cookie domain settings unset unless deliberate cross-host authentication is required.
- Choose one URLconf or implement explicit host-aware routing.
- Verify static assets, redirects, login, CSRF POSTs, invalid hosts, and forwarded-scheme behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
