I am using a php with apache. During vulnerability scan , host header injection was found. To fix this host header injection vulnerability i have implemented this code in my php application

$allowed_hosts = ['anubha.com', 'www.anubha.com'];
if (!in_array($_SERVER['HTTP_HOST'], $allowed_hosts)) {
    error_log('Invalid Host Header: ' . $_SERVER['HTTP_HOST']);
    header('HTTP/1.1 400 Bad Request');
    exit('Invalid Host Header');
}
 
But this does not work. To test this i have used a curl script.


$url = "https://www.anubha.com";
$ch = curl_init($url);
$headers = ["Host: google.com"];

curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); 

$response = curl_exec($ch);

if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {

    echo "Response: " . $response;
}
curl_close($ch);```
 
When i test this it is always redirecting to google.com. Can some one help me please ? Thanks