diff --git a/ProcessMaker/Http/Middleware/TrustHosts.php b/ProcessMaker/Http/Middleware/TrustHosts.php
index 68330a6e89..05d3539a8a 100644
--- a/ProcessMaker/Http/Middleware/TrustHosts.php
+++ b/ProcessMaker/Http/Middleware/TrustHosts.php
@@ -10,8 +10,21 @@ class TrustHosts extends Middleware
 {
     public function hosts(): array
     {
-        $trustedHost = $this->allSubdomainsOfApplicationUrl();
-        return [$trustedHost];
+        $hosts = array_filter([
+            $this->allSubdomainsOfApplicationUrl(),
+        ]);
+
+        $trustedHostsEnv = config('app.trusted_hosts_links', '');
+        if ($trustedHostsEnv !== '') {
+            foreach (array_filter(array_map('trim', explode(',', $trustedHostsEnv))) as $host) {
+                if (str_contains($host, '://')) {
+                    $host = parse_url($host, PHP_URL_HOST) ?: $host;
+                }
+                $hosts[] = '^(.+\.)?' . preg_quote($host) . '$';
+            }
+        }
+
+        return array_values($hosts);
     }
 
     public function handle(Request $request, $next)
diff --git a/config/app.php b/config/app.php
index ea6d3bbfb5..dbf57886bd 100644
--- a/config/app.php
+++ b/config/app.php
@@ -11,6 +11,9 @@
     // The url of our host, will usually be set during installation
     'url' => env('APP_URL', 'http://localhost'),
 
+    // Comma-separated list of additional trusted hosts (e.g. https://www.google.com)
+    'trusted_hosts_links' => env('TRUSTED_HOSTS_LINKS', ''),
+
     // The application key to be used for hashing secrets
     'key' => env('APP_KEY', 'base64:x80I9vQNxwllSuwBkTwfUa5qkgPTRdwqHCPSz7zHi1U='),