Nextcloud Shows “Access through untrusted domain”

Capture the exact hostname and port used in the browser

Record the browser hostname exactly as used, including a non-default port if one is present. Nextcloud supports exact hostnames, exact hostname-and-port entries, IP addresses, and limited wildcards in trusted_domains; do not normalize the observed value into a different host.[3]

Read only the trusted_domains value

Use the supported occ config namespace to read trusted_domains without dumping unrelated private configuration. Compare the returned entries with the hostname that produced the error.[4][3]

occ config:system:get trusted_domains

Keep proxy trust and URL rewriting out of this page

Do not add trusted_proxies, overwritehost, overwriteprotocol, or wildcard host trust merely because a reverse proxy exists. Those settings have different documented purposes and should be changed only under their own evidence.[5][3]

1. Verify the exact Nextcloud error

Confirm the response is the Nextcloud untrusted-domain page, not a TLS, DNS, web-server, or reverse-proxy error. The tagged template is the scope gate for this diagnosis.[2]

2. Compare the request host with trusted_domains

Read trusted_domains and compare each entry with the browser hostname and port. If the observed host is absent, the evidence selects the missing-host branch. If it appears present, inspect exact formatting and the possibility that the request is reaching a different Nextcloud instance before editing anything.[3][4]

3. If the host looks present, check format and destination

Confirm that the entry matches the exact hostname form accepted by Nextcloud, including any explicit port. If the list is correct, verify that DNS and the reverse proxy actually deliver this hostname to the intended Nextcloud instance; a different backend can have a different trusted_domains list.[3][5]

4. Preserve the current configuration before mutation

Record the current trusted_domains list and preserve a restorable configuration state. Do not place ad-hoc backup files ending in .config.php inside the active config directory because Nextcloud can load additional *.config.php files and let them override config.php.[3]

Add only the exact required host to trusted_domains

After proving the host is absent, add the exact hostname or hostname:port that users actually need. Prefer the supported occ config:system:set mechanism or an equally controlled config-management path. Do not use '*' as a normal fix and do not remove the trusted-domain check.[4][3]

Correct a proven hostname or port mismatch

If the intended host is present only in the wrong form, change that single entry to the exact hostname or hostname:port required by the documented trusted_domains format. Do not add proxy trust or overwrite settings as a substitute.[3]

If the list is correct, stop changing trust and verify routing

When the exact host is already trusted, keep the trust list unchanged and hand off the observed hostname, backend identity, DNS result, and reverse-proxy route to the operator. trusted_proxies and overwrite* settings belong to separate diagnoses unless new evidence selects them.[5][3]