# AWS ALB Host Header Rules:
Strengthening Traffic Control

In modern cloud architectures, controlling incoming traffic at the application layer is critical. Amazon Web Services **Application Load Balancer (ALB)** enables fine-grained routing using **listener rules**, including filtering based on host headers.

* * *

### What is a Host Header Rule?

A **Host header rule** ensures that only requests matching specific domain names (e.g., [`demo.cloud.com`](http://demo.cloud.com)) are allowed and routed to your backend.

This helps:

*   Route traffic to the correct service
    
*   Restrict access to only valid domains
    

* * *

### How to Configure (as shown in screenshot)

1.  Go to **EC2 → Load Balancers → Listeners**
    
2.  Select your **HTTPS:443 listener**
    
3.  Click **Add rule**
    
4.  Under **Conditions → Add condition → Host header**
    
5.  Enter your domain:
    
    *   Exact: [`demo.example.com`](http://app.example.com)
        
    *   Wildcard: `*.`[`example.com`](http://example.com)
        
6.  Set action → **Forward to target group**
    
7.  Assign **priority** (lower number = higher priority)
    

![](https://cdn.hashnode.com/uploads/covers/6685294b9ec528462cfa3646/8fc8681a-0cc4-460f-ad2e-aae8319898d6.png align="center")

![](https://cdn.hashnode.com/uploads/covers/6685294b9ec528462cfa3646/c112b4bf-2ac3-4a27-bedd-842d05f54086.png align="center")

![](https://cdn.hashnode.com/uploads/covers/6685294b9ec528462cfa3646/1b600250-8288-4996-83c5-a7ca23b33d92.png align="center")

* * *

### Important Behavior

*   Rules are evaluated **top-down (by priority)**
    
*   If no rule matches → **Default action is triggered** (commonly 403)
    

* * *

### Why It Matters

*   Prevents unwanted traffic hitting your backend
    
*   Reduces exposure via ALB DNS
    
*   Helps mitigate **Host Header Injection risks**
    

* * *

### Key Takeaway

Use **Host Header rules** to allow only trusted domains and enforce a **default deny (403)** for everything else.