diff --git a/docs/config.rst b/docs/config.rst
index 68f45d4402..737798502e 100644
--- a/docs/config.rst
+++ b/docs/config.rst
@@ -32,4 +32,14 @@ By default, InvenTree uses an sqlite database file : ``inventree_db.sqlite3``. T
 
 **MYSQL:** MySQL database backend is supported with the native Django implemetation.
 
-**POSTGRESQL:** PostgreSQL database backend is supported with the native Django implementation. Note that to use this backend, the ``psycopg2`` Python library must first be installed.
\ No newline at end of file
+**POSTGRESQL:** PostgreSQL database backend is supported with the native Django implementation. Note that to use this backend, the ``psycopg2`` Python library must first be installed.
+
+Allowed Hosts / CORS
+--------------------
+
+By default, all hosts are allowed, and CORS requests are enabled from any origin. **This is not secure and should be adjusted for your installation**. These options can be changed in the configuration file.
+
+For further information, refer to the following documentation:
+
+* `Django ALLOWED_HOSTS <https://docs.djangoproject.com/en/2.2/ref/settings/#allowed-hosts>`_
+* `Django CORS headers <https://github.com/OttoYiu/django-cors-headers>`_