diff --git a/.env.example b/.env.example
index c0b4e0e..3fbb104 100644
--- a/.env.example
+++ b/.env.example
@@ -7,6 +7,9 @@
 # Optional app port
 # PORT=3001
 
+# Optional reverse-proxy hosts for Docker self-hosting
+# ALLOWED_HOST=yourdomain.com
+
 # Optional image tag override for Docker self-hosting
 # OPEN_SEO_IMAGE=ghcr.io/every-app/open-seo:latest
 
diff --git a/compose.yaml b/compose.yaml
index 6d2fb9d..42b718e 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -6,6 +6,7 @@ services:
       # Required for local Docker self-hosting: exposes Compose env vars to cloudflare:workers bindings.
       - CLOUDFLARE_INCLUDE_PROCESS_ENV=true
       - PORT=${PORT:-3001}
+      - ALLOWED_HOST=${ALLOWED_HOST:-}
       - AUTH_MODE=local_noauth
       - DATAFORSEO_API_KEY=${DATAFORSEO_API_KEY}
       - VITE_SHOW_DEVTOOLS=false
diff --git a/docs/SELF_HOSTING_DOCKER.md b/docs/SELF_HOSTING_DOCKER.md
index 8606a73..3dee4da 100644
--- a/docs/SELF_HOSTING_DOCKER.md
+++ b/docs/SELF_HOSTING_DOCKER.md
@@ -2,7 +2,7 @@
 
 Run OpenSEO locally with Docker.
 
-In Docker mode, OpenSEO uses `AUTH_MODE=local_noauth` (no auth checks, local admin user `admin@localhost`).
+In Docker mode, OpenSEO uses `AUTH_MODE=local_noauth` (no auth checks, local admin user `admin@localhost`). Only expose it behind your own auth-protected reverse proxy, tunnel, or private network.
 
 The default `compose.yaml` uses the published GHCR image:
 
@@ -26,9 +26,18 @@ Docker Compose passes `.env` values into the container, and `compose.yaml` enabl
 Optional env values:
 
 - `PORT` (defaults to `3001`)
+- `ALLOWED_HOST` (single reverse-proxy hostname to allow in Vite preview)
 - `AUTH_MODE=local_noauth` (already set in compose)
 - `OPEN_SEO_IMAGE` (defaults to `ghcr.io/every-app/open-seo:latest`)
 
+If you are putting Docker behind a reverse proxy or a temporary tunnel, remember that Docker self-hosting runs with app auth disabled. Only expose it behind your own auth-protected reverse proxy, tunnel, or private network, and add the public hostname before restarting:
+
+```bash
+ALLOWED_HOST=yourdomain.com docker compose up -d
+```
+
+You can also persist it in `.env`.
+
 ## Pin to a specific image tag
 
 Set `OPEN_SEO_IMAGE` in `.env` and restart:
diff --git a/vite.config.ts b/vite.config.ts
index 372a2ca..04bc689 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -10,12 +10,17 @@ export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), "");
   const port = env.PORT ? Number(env.PORT) : 3001;
   const showDevtools = env.VITE_SHOW_DEVTOOLS !== "false";
+  const allowedHosts = env.ALLOWED_HOST ? [env.ALLOWED_HOST] : undefined;
 
   return {
     envPrefix: ["VITE_"],
     server: {
       port,
     },
+    preview: {
+      allowedHosts,
+      port,
+    },
     plugins: [
       showDevtools
         ? devtools({