diff --git a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
index 8caff5691b66..667cf47e65f7 100644
--- a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
+++ b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
@@ -352,7 +352,6 @@ private void showEnforcedServers() {
         showAuthStatus();
         accountSetupBinding.hostUrlFrame.setVisibility(View.GONE);
         accountSetupBinding.hostUrlInputHelperText.setVisibility(View.GONE);
-        accountSetupBinding.scanQr.setVisibility(View.GONE);
         accountSetupBinding.serversSpinner.setVisibility(View.VISIBLE);
 
         ArrayAdapter<String> adapter = new ArrayAdapter<>(this, R.layout.enforced_servers_spinner);
@@ -650,6 +649,13 @@ public void parseAndLoginFromWebView(String dataString) {
             String prefix = getString(R.string.login_data_own_scheme) + PROTOCOL_SUFFIX + "login/";
             LoginUrlInfo loginUrlInfo = parseLoginDataUrl(prefix, dataString);
 
+            if (!checkAllowedServers(loginUrlInfo.getServer())) {
+                mServerStatusIcon = R.drawable.ic_alert;
+                mServerStatusText = getString(R.string.server_not_allowed);
+                showServerStatus();
+                return;
+            }
+
             if (accountSetupBinding != null) {
                 accountSetupBinding.hostUrlInput.setText("");
             }
@@ -660,10 +666,36 @@ public void parseAndLoginFromWebView(String dataString) {
             mServerStatusIcon = R.drawable.ic_alert;
             mServerStatusText = getString(R.string.qr_could_not_be_read);
             showServerStatus();
+            return;
         }
         checkOcServer();
     }
 
+    private boolean checkAllowedServers(@NonNull String server) {
+        String webviewLogin = getString(R.string.webview_login_url);
+
+        if (!webviewLogin.isEmpty() && webviewLogin.startsWith(server)) {
+            return true;
+        }
+
+        String enforcedServerList = getString(R.string.enforce_servers);
+
+        if (!enforcedServerList.isEmpty()) {
+            ArrayList<EnforcedServer> enforcedServers = new Gson().fromJson(enforcedServerList,
+                                                                            new TypeToken<ArrayList<EnforcedServer>>() {
+                                                                            }
+                                                                                .getType());
+
+            for (EnforcedServer enforcedServer : enforcedServers) {
+                if (enforcedServer.getUrl().startsWith(server)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
     /**
      * parses a URI string and returns a login data object with the information from the URI string.
      *
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index c1589ad6f91d..fa3557334b9e 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -1638,4 +1638,5 @@
     <string name="player_control_view_play_pause_button_content_description">Play/Pause button</string>
     <string name="player_control_view_next_button_content_description">Next button</string>
     <string name="player_control_view_random_button_content_description">Random button</string>
+    <string name="server_not_allowed">Server not allowed</string>
 </resources>