Every server option that changes what localhost:5173 does

Where the options live

One key, one nesting level. Options under build, preview or optimizeDeps do not touch the dev server, even when they carry a similar name — preview.port moves 4173, not 5173.

import { defineConfig } from 'vite'

export default defineConfig({
  server: {
    host: true,          // listen on the LAN too
    port: 5173,          // the default, spelled out
    strictPort: true,    // fail instead of moving to 5174
  },
})

Which options decide whether 5173 answers at all

These five run before a single request is served. Four of them produce a symptom that looks like a network problem and is not.

• server.host — default "localhost". Listens on the loopback interface only. Set to true or 0.0.0.0 to answer on the LAN. Symptom: the page works on your machine, nothing else reaches it. Explained on /vite-host/.
• server.port — default 5173. If the port is taken, Vite moves to the next free one instead of failing, so this is not necessarily the port you end up on. Explained on /change-port/.
• server.strictPort — boolean, off unless you set it. Exits instead of sliding to 5174. The one option that makes a busy port visible. Explained on /port-in-use/.
• server.allowedHosts — default []. localhost, anything under .localhost and all IP addresses are allowed anyway; the check is skipped entirely over HTTPS. Symptom: "Blocked request. This host is not allowed." Explained on /allowed-hosts/.
• server.https — an options object handed to https.createServer(). No default, and it needs a real certificate. Explained on /vite-https/.

Which options decide what happens to a request

Once the server listens, these decide who may ask and where the answer comes from. server.proxy and server.cors are the two that get confused for each other most often.

• server.proxy — a { key: options } map. Any request path starting with the key is forwarded; a key beginning with ^ is read as a RegExp. A request matched by a proxy rule is not transformed by Vite. Explained on /vite-proxy/.
• server.cors — default { origin: /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/ }, that is localhost, 127.0.0.1 and ::1. The docs flag cors: true as dangerous, because any website may then read your source. Explained on /vite-cors/.
• server.headers — response headers for everything the dev server sends. No default.
• server.origin — the origin written into generated asset URLs during development. Relevant when a backend on another port embeds Vite assets.
• server.fs.strict — default true since Vite 2.7. Files outside the workspace root are not served.
• server.fs.deny — default [".env", ".env.*", "*.{crt,pem,key,p12,pfx,cer,der}", ".npmrc", ".yarnrc.yml", "**/.git/**"]. Outranks fs.allow, and explicitly does not apply to the public directory, whose files are served unfiltered.

Which options belong to reloading

The socket and the watcher. Note the rename: the WebSocket settings that used to sit under server.hmr now have their own key.

• server.ws — the WebSocket connection: protocol, host, port, path, timeout, clientPort, server. Set to false to switch the socket off completely.
• server.hmr — boolean or { overlay }. The WebSocket options protocol, host, port, path, clientPort, timeout and server are deprecated here in favour of server.ws; the docs state the two are synced automatically, so older configs keep working. Explained on /vite-hmr/.
• server.watch — options passed to chokidar. Files inside node_modules cannot be watched (Vite issue #8619), and on WSL2 a file edited by a Windows process is not seen at all.
• server.warmup — { clientFiles, ssrFiles }. Transforms named files ahead of the first request to avoid a transform waterfall on startup.

The two options you will not have met before

Both are recent, and neither appears in an answer written before 2025.

• server.forwardConsole — default auto: true when an AI coding agent is detected via @vercel/detect-agent, otherwise false. It forwards unhandled browser errors and console.error / console.warn into the terminal that runs the dev server. If browser errors suddenly show up in your terminal, this is why.
• server.sourcemapIgnoreList — default (sourcePath) => sourcePath.includes("node_modules"). Fills the x_google_ignoreList extension so DevTools hides dependency frames. It is a dev-server option and does not inherit from the Rolldown build option of the same name.

A CLI flag reaches five of them

The dev command takes --host, --port, --open, --cors and --strictPort. There is no flag for allowedHosts, proxy, headers, fs or ws — those exist in the config file only, which is why a one-off run cannot work around a blocked host.

$ npm run dev -- --host --port 3000 --strictPort
# same as server: { host: true, port: 3000, strictPort: true }

$ npm run dev -- --allowedHosts example.com
error: unknown option '--allowedHosts'

server.middlewareMode changes the rules

Default false. Set it, and Vite no longer owns a port at all — it becomes middleware inside your own HTTP server, and 5173 stops being part of the picture. If a project uses middleware mode, none of the port and host advice above applies to it; the surrounding server decides the address.

• Changing the port the Vite dev server usesSet server.port in vite.config.js, or pass --port on the command line; add strictPort: true if you want Vite to fail instead of silently moving to the next free port.
• Reaching localhost:5173 from your phone or another machineThe dev server listens on localhost by default, so nothing else on the network can reach it — start it with --host (or set server.host) to listen on your LAN address.
• Blocked request. This host is not allowed.The Vite dev server only answers to localhost, hostnames ending in .localhost, and IP addresses — every other hostname has to be listed in server.allowedHosts.
• Proxying API requests from the Vite dev serverserver.proxy forwards any request whose path starts with a given prefix to another server, so the browser only ever talks to localhost:5173 and no CORS error appears.
• CORS errors around localhost:5173The Vite dev server only accepts cross-origin requests from localhost, 127.0.0.1 and ::1 by default — anything else has to be allowed explicitly, and setting cors to true opens it to every website.
• Hot Module Replacement on localhost:5173HMR swaps a changed module in the running page over a WebSocket instead of reloading it; when that WebSocket cannot connect, Vite falls back to full page reloads or stops updating at all.
• How every claim on this site is verifiedEvery page here is checked against one named Vite release — 8.3.0, published 2026-09-10 — in three places in a fixed order: the documentation, the source at that release tag, and a local reproduction, and the date of that check is printed at the foot of the page.
• localhost:5173 — the port itselfWhat the address means, common dev ports, and the autocomplete fix.