By default, the
url option is not set and Kirby will try to auto-detect your base URL, based on the
Alternatively, you can hard-code the base
url to switch off auto-detection.
Since Kirby 3.6.3, you'll have a couple additional options to control auto-detection and set an allow list of accepted base URLs:
Just like before, you can ignore the URL option or use the
Server::HOST_FROM_SERVER constant to let Kirby find the correct base URL, based on the
… or …
This can be combined with the new
Server::HOST_ALLOW_EMPTY option to accept empty hostnames. This will lead to relative URLs i.e.
/some-url for your installation if the SERVER_NAME is not set or empty.
You can also still set the base URL for your site. This will disable any form of auto-detection of URLs. But it also means that you might have to keep different versions for your local installation, staging and your production server. We recommend multi-environment config files for this.
This also still works for relative URLs without a host.
With the new option to define a set of allowed base URLs, your Kirby installation will automatically pick the right one based on
SERVER_NAME (whatever is provided) and makes sure to send an error on an invalid hosts. This is perfect when you cannot fully trust your server configurations on various environments or you work with a reverse proxy.
You can also define base URLs with subfolders here and the subfolders will be validated too.
If you fully trust your server setup, you can allow any host name coming from
HTTP_X_FORWARDED_HOST. This could be necessary in some situations, but is insecure if you don't know what you are doing with your server configuration.
Again, this can be combined with the
Server::HOST_ALLOW_EMPTY option to allow the host name to be left empty. It will lead to relative URLs for your installation: