diff --git a/cmd/utils/flags.go b/cmd/utils/flags.go
index 117030b20c..a0e5c053f0 100644
--- a/cmd/utils/flags.go
+++ b/cmd/utils/flags.go
@@ -385,7 +385,7 @@ var (
 	}
 	RPCAllowedHostsFlag = cli.StringFlag{
 		Name:  "rpcallowedhosts",
-		Usage: "Comma separated list of hostnames from which to accept requests (server enforced)",
+		Usage: "Comma separated list of hostnames from which to accept requests (server enforced). Set to * to disable this protection.",
 		Value: "localhost,127.0.0.1",
 	}
 	RPCApiFlag = cli.StringFlag{
diff --git a/node/api.go b/node/api.go
index 3cd54b06a6..29a5d95f7a 100644
--- a/node/api.go
+++ b/node/api.go
@@ -142,7 +142,7 @@ func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis
 	}
 
 	allowedHosts := api.node.config.HTTPHosts
-	if hosts != nil{
+	if hosts != nil {
 		allowedHosts = nil
 		for _, host := range strings.Split(*host, ",") {
 			allowedHosts = append(allowedHosts, strings.TrimSpace(host))
diff --git a/node/node.go b/node/node.go
index 6ae6dce1fc..aa41eb7cc0 100644
--- a/node/node.go
+++ b/node/node.go
@@ -395,7 +395,7 @@ func (n *Node) startHTTP(endpoint string, apis []rpc.API, modules []string, cors
 	}
 	go rpc.NewHTTPServer(cors, allowedHosts, handler).Serve(listener)
 	n.log.Info(fmt.Sprintf("HTTP endpoint opened: http://%s", endpoint))
-	n.log.Info(fmt.Sprintf("HTTP config: cors %v, hosts%v", cors,allowedHosts))
+	n.log.Info(fmt.Sprintf("HTTP config: cors %v, hosts%v", cors, allowedHosts))
 	// All listeners booted successfully
 	n.httpEndpoint = endpoint
 	n.httpListener = listener
diff --git a/rpc/http.go b/rpc/http.go
index c96f1842bd..047cdf6b37 100644
--- a/rpc/http.go
+++ b/rpc/http.go
@@ -143,7 +143,7 @@ func (t *httpReadWriteNopCloser) Close() error {
 // NewHTTPServer creates a new HTTP RPC server around an API provider.
 //
 // Deprecated: Server implements http.Handler
-func NewHTTPServer(cors []string, hosts[] string, srv *Server) *http.Server {
+func NewHTTPServer(cors []string, hosts []string, srv *Server) *http.Server {
 	// Wrap the CORS-handler within a host-handler
 	handler := newCorsHandler(srv, cors)
 	handler = newHostHandler(hosts, handler)
@@ -224,8 +224,9 @@ func (h *hostHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		hostpart := parseHost(r.Host)
 		requestAllowed := false
 		for _, allowedHost := range h.AllowedHosts {
-			if strings.ToLower(allowedHost) == hostpart {
+			if strings.ToLower(allowedHost) == hostpart || allowedHost == "*" {
 				requestAllowed = true
+				break
 			}
 		}
 		if !requestAllowed {