What it means
Something tried to log in or call the API with a wrong password or an expired token. After several attempts with ip_ban_enabled the address is banned.
Why it happens
- An old session in the companion app or a browser tab after a password change.
- An integration or script with an outdated long-lived token.
- A scanner or bot from the internet if Home Assistant is exposed directly.
- Behind a proxy without trusted_proxies every request seems to come from the proxy address, so one mistake bans everyone.
How to fix it
- Find the device by the address in the message and log in again (the app: Settings → Companion app → server → log out and in).
- Recreate long-lived tokens in your profile → Security.
- If you were banned: delete the address from ip_bans.yaml in the config folder and restart.
- If the address is from the internet, close direct access and use a tunnel, proxy or WireGuard.
Useful tools
/home-assistant-remote-access/ · What is my IP
Other Home Assistant errors
- A request from a reverse proxy was received from 172.30.33.0, but your HTTP integration is
- Received X-Forwarded-For header from an untrusted proxy 172.18.0.2
- Invalid config for 'automation' at automations.yaml, line 3: required key 'triggers' not p
- Template variable warning: 'dict object' has no attribute 'to_state' when rendering '{{ tr
- Setup failed for 'hacs': Integration not found.