What causes "Hostname cannot contain a port" in cloudflare/cloudflared?

Strip the port from the hostname field: use 'app.example.com'

Hostname cannot contain a port

Error message

Hostname cannot contain a port

What it means

errHostnameContainsPort is returned when an ingress rule's hostname field includes a port (e.g. 'example.com:8080'). The hostname field must be a bare hostname; the destination port belongs in the service URL, not the hostname match pattern.

Source

Thrown at ingress/ingress.go:26

	"strconv"
	"strings"

	"github.com/pkg/errors"
	"github.com/rs/zerolog"
	"github.com/urfave/cli/v2"
	"golang.org/x/net/idna"

	"github.com/cloudflare/cloudflared/config"
	"github.com/cloudflare/cloudflared/ingress/middleware"
	"github.com/cloudflare/cloudflared/ipaccess"
)

var (
	ErrNoIngressRules             = errors.New("The config file doesn't contain any ingress rules")
	ErrNoIngressRulesCLI          = errors.New("No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests")
	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)")
	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
	errHostnameContainsPort       = errors.New("Hostname cannot contain a port")
	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
)

const (
	ServiceBastion     = "bastion"
	ServiceSocksProxy  = "socks-proxy"
	ServiceWarpRouting = "warp-routing"
)

// FindMatchingRule returns the index of the Ingress Rule which matches the given
// hostname and path. This function assumes the last rule matches everything,
// which is the case if the rules were instantiated via the ingress#Validate method.
//
// Negative index rule signifies local cloudflared rules (not-user defined).
func (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {
	// The hostname might contain port. We only want to compare the host part with the rule
	host, _, err := net.SplitHostPort(hostname)
	if err == nil {

View on GitHub (pinned to 2253eeeb25)

Solutions

Strip the port from the hostname field: use 'app.example.com'
Put the port in the service URL instead, e.g. service: 'http://localhost:8080'
Re-run 'cloudflared tunnel ingress validate'

Example fix

// before
hostname: "app.example.com:8443"
// after
hostname: "app.example.com"
service: "https://localhost:8443"

Defensive patterns

Strategy: validation

Validate before calling

func hostnameHasPort(h string) bool { _, _, err := net.SplitHostPort(h); return err == nil }

Prevention

Keep hostname fields bare; ports belong in the service URL
Never paste full origin URLs into the hostname field
Validate configs before running the tunnel

When it happens

Trigger: validateHostname calls net.SplitHostPort(r.Hostname) and it succeeds, meaning the hostname string contains a host:port pair such as 'app.example.com:8443'.

Common situations: Users porting an origin URL like 'http://app.example.com:8080' into the hostname field, or intending to match traffic on a specific port instead of setting it in the service URL.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/d0086554ae7fb593. Report an issue: GitHub.