Skip to content
Grav 2.0 is officially stable. Read the announcement →
Support

Email links are not yet pinned to a trusted host,

Solved by Andy Miller View solution

Started by TomW 3 weeks ago · 4 replies · 273 views
3 weeks ago

Hello,

On the admin page, I’m getting the error message “Email links are not yet bound to a trusted host.” When I follow the instructions at https://learn.getgrav.org/20/security/trusted-host#the-fix (Option 1), my website no longer displays correctly. Unfortunately, as a new user, I can’t upload any images yet. Maybe it’ll work in my next post.

What am I doing wrong?

3 weeks ago

Here's the link to the screenshots -> https://abigailsh.privatedns.org/index.php/s/nnZbAfNkZkdHmAn

last edited 07/23/26 by TomW
3 weeks ago

what did you do 'exactly' ?

3 weeks ago

I set the "custom_base_url: '' " in "user\config" to 'https://www.meinedomain.de'

3 weeks ago Solution

The Custom Base URL isn't really the setting you want here, and it's almost
certainly what broke your site's display.

Custom Base URL changes how Grav builds every URL on the site, not just the
ones in emails. Two things commonly go wrong with it:

  1. If Grav is installed in a subfolder (for example
    https://www.meinedomain.de/grav), the Custom Base URL must include that
    folder: https://www.meinedomain.de/grav. If you leave the folder off, Grav
    drops it from every CSS, JS and image URL and the site renders unstyled.

  2. It must match exactly how you reach the site in the browser, including www
    vs non-www and http vs https. If you browse https://meinedomain.de but pin
    the base to https://www.meinedomain.de, things can break in the same way.

The good news: you don't need Custom Base URL to clear that warning. The
warning only asks that email links are pinned to a host you trust, and the
Login plugin has its own setting for exactly that, which touches nothing else
on the site.

So do this instead:

  1. Set Custom Base URL back to empty (Configuration > System > Advanced, or
    custom_base_url: '' in user/config/system.yaml). Your site should display
    correctly again.

  2. Go to Plugins > Login > Security > Site Host and enter your site address,
    for example https://www.meinedomain.de

    Or in user/config/plugins/login.yaml:

    site_host: 'https://www.meinedomain.de'

  3. Clear the cache (bin/grav clear) and reload the admin. The warning should
    be gone.

That's option 2 on the docs page, and for most sites it's the better one to
reach for.

If you'd still like to get Custom Base URL working, tell me the exact address
you type into the browser to reach the site (including any folder after the
domain), and what "no longer displays correctly" looked like: missing styles,
broken images, or a blank page? That will tell us straight away which of the
two problems above you hit.

Suggested topics

Topic Participants Replies Views Activity
Support · by Anna, 1 week ago
4 327 9 hours ago
Support · by gtx, 2 weeks ago
4 331 1 week ago
Support · by Paul Hodges, 3 weeks ago
13 375 2 weeks ago
Support · by Anna, 4 weeks ago
9 433 2 weeks ago
Support · by Anna, 3 weeks ago
4 269 3 weeks ago