diff --git a/config/settings/production.py b/config/settings/production.py
index 5bbd7ef..3d6b2b5 100644
--- a/config/settings/production.py
+++ b/config/settings/production.py
@@ -10,7 +10,14 @@ from .base import *
 # Security
 SECRET_KEY = os.environ['SECRET_KEY']
 DEBUG = False
-ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
+
+# ALLOWED_HOSTS must be explicitly set in production
+if not os.environ.get('ALLOWED_HOSTS'):
+    raise ValueError(
+        "ALLOWED_HOSTS environment variable is required in production. "
+        "Set to comma-separated list of allowed domains (e.g., 'example.com,www.example.com')"
+    )
+ALLOWED_HOSTS = os.environ['ALLOWED_HOSTS'].split(',')
 
 # Force HTTPS
 SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')