What it means
Home Assistant got a request with an X-Forwarded-For header from a proxy it does not trust, and answered 400: Bad Request.
Why it happens
- A reverse proxy (nginx, Caddy, Nginx Proxy Manager, the Cloudflared add-on) is in front of Home Assistant, but configuration.yaml has no http: block for it.
- use_x_forwarded_for is on, but the proxy’s address is not in trusted_proxies.
How to fix it
- Add to configuration.yaml: http: use_x_forwarded_for: true and trusted_proxies with the address from the message (for HA OS add-ons: 172.30.33.0/24).
- Check the configuration (Developer tools → YAML) and restart Home Assistant: http: changes need a full restart.
- The remote access generator writes the right block for each proxy type.
Useful tools
/home-assistant-remote-access/ · /home-assistant-yaml-checker/
Other Home Assistant errors
- Received X-Forwarded-For header from an untrusted proxy 172.18.0.2
- Login attempt or request with invalid authentication from 192.168.1.50 (192.168.1.50). Req
- Invalid config for 'automation' at automations.yaml, line 3: required key 'triggers' not p
- Template variable warning: 'dict object' has no attribute 'to_state' when rendering '{{ tr
- Setup failed for 'hacs': Integration not found.