Trusted proxy headers on Acquia Cloud Platform for Drupal sites


The content in this document applies to websites running on Drupal 8 or later. Note that Drupal 8 reached end-of-life on November 2, 2021. For more information, see Frequently Asked Questions.

To ensure that Acquia Cloud Platform follows the best practices of the Drupal community, the configuration process for trusted proxy headers on Drupal 8+ sites is updated.


This change does not impact Drupal 7 sites on Acquia Cloud Platform.

Changes to Drupal 8+

Drupal 8+ supports the following proxy headers:

  • X-Forwarded-For
  • X-Forwarded-Host
  • X-Forwarded-Port
  • X-Forwarded-Proto
  • Forwarded

However, Acquia Cloud Platform trusts the following proxy headers by default:

  • X-Forwarded-For
  • X-Forwarded-Proto

To ensure that Acquia Cloud Platform trusts the other supported proxy headers, you can re-enable such headers by updating your site’s settings.php file. For more information, see Ensuring that an application trusts the proxy headers. This applies to cases when your application uses other headers.

Verifying the proxy headers used by an application


This procedure is applicable if your application has another proxy layer, such as CDN, before Acquia Cloud Platform.

To view the list of proxy headers used by your application:

  1. Access your Acquia-hosted Drupal site as an admin user. Ensure that you use the same public domain that your visitors use and not the * domain.
  2. Access Admin > Reports > Status Report > PHP (/admin/reports/status/php) where the request headers used by the application is displayed.

To enable the proxy headers, add the code mentioned in the Ensuring that an application trusts the proxy headers section.


When accessing your site pages, if you use a domain that bypasses the CDN, you won’t see any HTTP headers added by the proxy layer.

For any assistance, contact Acquia support.

Ensuring that an application trusts the proxy headers

If your application uses other trusted proxy headers, you must add a setting for each header to your settings.php file after the require line. For example,

   // Trust the X-Forwarded-Host header.
if (isset($settings['reverse_proxy_trusted_headers'])) {
$settings['reverse_proxy_trusted_headers'] |= \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST;


$settings['reverse_proxy_host_header'] = 'X_FORWARDED_HOST';


For other proxy headers, access Drupal’s default.settings.php file.

Acquia recommends that you test the behavior to ensure that the change does not impact your application.