Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. drivers
  5. etc
  6. hosts
FileRisk: Caution

hosts C:\Windows\System32\drivers\etc\hosts

Text file of host name to IP address entries that Windows reads before DNS; used for tests and blocks, and a classic malware target.

Updated on By AltF4 Formation

What it’s for

hosts is a text file that maps a host name to an IP address. Windows reads it before querying DNS, so you can use it to test a site before cutover, block a name or redirect a name locally. One bad line is enough to break resolution for that name, and malware targets the file for the same reason, to hijack a bank or security vendor site.

What it contains

  • A header comment supplied by Windows. The default file has no active entry: the localhost examples are commented out.
  • Lines in the form “IP-address host-name”, for example 127.0.0.1 example.local, one entry per line. Anything after a # is a comment.
  • The file has no extension. The drivers\etc folder is exempt from WOW64 redirection, so a 32-bit application sees the same file.

Risks and best practices

  • Edit it in an editor started as administrator, or saving fails. Keep a copy first, and flush the client DNS cache afterwards (ipconfig /flushdns). The PowerToys Hosts File Editor makes the backup for you.
  • An abnormally long file, or one that mentions banks or security vendors, is suspicious.
  • To return to the original state, paste in the default template published by Microsoft.

Useful commands

Fenêtre de terminal
# Active entries (no comments or blank lines)
Get-Content "$env:windir\System32\drivers\etc\hosts" | Where-Object { $_ -and $_ -notmatch '^\s*#' }


# Modification date, handy to spot an unexpected change
Get-Item "$env:windir\System32\drivers\etc\hosts" | Select-Object FullName, LastWriteTime, Attributes


# As administrator: back up before editing (remove -WhatIf to run)
Copy-Item "$env:windir\System32\drivers\etc\hosts" "$env:windir\System32\drivers\etc\hosts.bak" -WhatIf


# Flush the client DNS cache
ipconfig /flushdns

Report a mistake