diff --git a/config/settings/base.py b/config/settings/base.py
index 909dc25..85252be 100644
--- a/config/settings/base.py
+++ b/config/settings/base.py
@@ -7,6 +7,11 @@ VERSION = "0.1.0"
 
 CORS_ORIGIN_ALLOW_ALL = DEBUG
 
+if not DEBUG:
+    import socket
+    ALLOWED_HOSTS.append(socket.gethostbyname(socket.gethostname()))
+
+
 DJANGO_APPS = [
     "unfold",  # before django.contrib.admin
     "django.contrib.admin",
diff --git a/config/settings/environ.py b/config/settings/environ.py
index 6aa4388..76d8011 100644
--- a/config/settings/environ.py
+++ b/config/settings/environ.py
@@ -14,6 +14,8 @@ if os.path.exists(env_file):
 SECRET_KEY = env.str("SECRET_KEY", "this-is-the-default-secret-key")
 DEBUG = env.bool("DEBUG", True)
 
+CORS_ORIGIN_WHITELIST = env.str('CORS_ORIGIN_WHITELIST', default='').split(',')
+
 DATABASE_URL = env.db_url("DATABASE_URL", "sqlite:///db.sqlite3")
 
 STATIC_ROOT = env.str("STATIC_ROOT", "static")