diff --git a/nodejs/services/host_lookup.js b/nodejs/services/host_lookup.js
index 0392ed7..aafa546 100644
--- a/nodejs/services/host_lookup.js
+++ b/nodejs/services/host_lookup.js
@@ -35,6 +35,16 @@ const socket = new SocketServerJson({
 			// If we don't have a match, return empty object
 			if(!parentHost) return clientSocket.write(JSON.stringify({}));
 
+			// A wildcard host with matchAny disabled only serves subdomains that
+			// are explicitly defined in redis. Reaching this service means redis
+			// had no direct entry for the requested domain, so an inexact match
+			// here (the request isn't the wildcard host itself) is an undefined
+			// subdomain and must not be routed to the wildcard parent.
+			if(parentHost.is_wildcard && !parentHost.wildcard_matchAny
+					&& parentHost.host !== data['domain']){
+				return clientSocket.write(JSON.stringify({}));
+			}
+
 			// If the matched host belongs to a wildcard domain, set wildcard_parent
 			// This allows child domains to use the parent's wildcard SSL certificate
 			if(!parentHost.wildcard_parent){
diff --git a/nodejs/views/hosts.ejs b/nodejs/views/hosts.ejs
index 8a014bb..fc061ed 100755
--- a/nodejs/views/hosts.ejs
+++ b/nodejs/views/hosts.ejs
@@ -99,6 +99,8 @@
 
 		if(host.is_wildcard){
 			$('.hostEditPanel [name="host"]').attr('disabled', true);
+			// Allow toggling the wildcard matching mode when editing a wildcard host.
+			$('.hostEditPanel #wildcard_matchAny-container').removeClass('challengeType-container');
 		}
 
 		$.each(host, function( key, value ) {			if(typeof value == "boolean"){
@@ -173,6 +175,7 @@
 			// Reset the allowed types on start
 			$('#challengeType-child-container').addClass('challengeType-container');
 			$('#challengeType-DNS-01-wildcard-container').addClass('challengeType-container');
+			$('#wildcard_matchAny-container').addClass('challengeType-container');
 
 			let host = $hostField.val();
 
@@ -180,6 +183,8 @@
 			// provider.
 			if(host.startsWith("*.") && await verifyWildcardRequirements(host)){
 				$('#challengeType-DNS-01-wildcard-container').removeClass('challengeType-container');
+				// Wildcard matching mode only applies to wildcard hosts.
+				$('#wildcard_matchAny-container').removeClass('challengeType-container');
 
 				return;
 			}
@@ -363,6 +368,24 @@
 						</div>
 					</div>
 
+					<div class="form-group challengeType-container" id="wildcard_matchAny-container">
+						<label class="form-label">
+							Wildcard Matching
+						</label>
+						<div class="radio">
+							<label>
+								<input type="radio" name="wildcard_matchAny" id="wildcard_matchAny-false" value="false" checked>
+								Match only subdomains defined here <b>Recommended</b>
+							</label>
+						</div>
+						<div class="radio">
+							<label>
+								<input type="radio" name="wildcard_matchAny" id="wildcard_matchAny-true" value="true">
+								Match any subdomain and proxy to this host
+							</label>
+						</div>
+					</div>
+
 					<div class="mb-3 form-group">
 						<label for="ip" class="form-label">
 							Target IP or Host Name