# X_SHOT_HOST_REFUSED

## Means

x shot was asked to open a host outside the run's allow list

## Typical cause

a `goto` to a host no `allowHosts` rule matches, refused before `Page.navigate` is sent. A request the PAGE makes to such a host is not this code — it is paused in the browser (`Fetch.requestPaused`), failed, and recorded in `verdict.json` as `refused: "host"`

## Fix

`x shot /route --allow-hosts cdn.example.com` — the app's own host is always allowed

[Encrypted secrets](/error-codes#encrypted-secrets)