If you are using a wildcard DNS like *.sparrow.host
, visiting foo.sparrow.host/index.php
should show Host header = foo.sparrow.host
and the parsed subdomain as foo
.
Security note: do not trust X-Forwarded-For
or HTTP_X_FORWARDED_FOR
unless your server sits behind a trusted proxy/load-balancer that sets it. Also sanitize any values before using them in logs or UI.