# ASTRO_FORMS_REFUSED

**What it means.** This Astro app runs as a server, and its config does not let it read the address visitors open, so here it would refuse every form its own pages send ("Cross-site POST form submissions are forbidden") and Astro.url would say http://localhost.

**What to do.** Add security: { allowedDomains: [{ protocol: "https" }] } inside defineConfig({ ... }) in astro.config.mjs, then deploy again. Astro then reads the visitor's address from X-Forwarded-Host, which the platform sets on every request and visitors cannot, custom domains included, and still refuses forms sent from other sites. This is a warning; deploy continues.

- HTTP status: 422
- Retryable after applying the fix: yes

Every failure from the CLI or an MCP tool has this shape:

```json
{
  "ok": false,
  "code": "ASTRO_FORMS_REFUSED",
  "message": "This Astro app runs as a server, and its config does not let it read the address visitors open, so here it would refuse every form its own pages send (\"Cross-site POST form submissions are forbidden\") and Astro.url would say http://localhost.",
  "fix": "Add security: { allowedDomains: [{ protocol: \"https\" }] } inside defineConfig({ ... }) in astro.config.mjs, then deploy again. Astro then reads the visitor's address from X-Forwarded-Host, which the platform sets on every request and visitors cannot, custom domains included, and still refuses forms sent from other sites. This is a warning; deploy continues.",
  "file": "<where to edit, when known>",
  "retryable": true,
  "docs": "https://docs.uarpie.app/errors/ASTRO_FORMS_REFUSED"
}
```

Apply `fix` (edit `file` when it is given), then run the same command again.