diff --git a/core/modules/filter/config/schema/filter.schema.yml b/core/modules/filter/config/schema/filter.schema.yml
index f1df7df..bebf030 100644
--- a/core/modules/filter/config/schema/filter.schema.yml
+++ b/core/modules/filter/config/schema/filter.schema.yml
@@ -69,6 +69,16 @@ filter_settings.filter_html:
       type: boolean
       label: 'HTML nofollow'
 
+filter_settings.filter_html_image_secure:
+  type: filter
+  label: 'Filter HTML image secure'
+  mapping:
+    domains:
+      type: sequence
+      label: 'Accepted domains'
+      sequence:
+        - type: string
+          label: 'Value'
 
 filter_settings.filter_url:
   type: filter
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index 40eda67..dea4803 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -1057,7 +1057,7 @@ function _filter_html_escape($text) {
 /**
  * Process callback for local image filter.
  */
-function _filter_html_image_secure_process($text) {
+function _filter_html_image_secure_process($text, $domains) {
   // Find the path (e.g. '/') to Drupal root.
   $base_path = base_path();
   $base_path_length = drupal_strlen($base_path);
@@ -1070,8 +1070,20 @@ function _filter_html_image_secure_process($text) {
   foreach ($images as $image) {
     $src = $image->getAttribute('src');
     // Transform absolute image URLs to relative image URLs: prevent problems on
-    // multisite set-ups and prevent mixed content errors.
-    $image->setAttribute('src', file_url_transform_relative($src));
+    // multisite set-ups and prevent mixed content errors. Use the configured
+    // list of allowed domains, if set.
+    if (!empty($domains)) {
+      $url = parse_url($src);
+      // If the URL has a host, check if it is in the list of allowed domains.
+      if (isset($url['host']) && isset($url['path']) && in_array($url['host'], $domains)) {
+        // Only images in the filesystem will pass verification, do not bother
+        // with query.
+        $image->setAttribute('src', $url['path']);
+      }
+    }
+    else {
+      $image->setAttribute('src', file_url_transform_relative($src));
+    }
 
     // Verify that $src starts with $base_path.
     // This also ensures that external images cannot be referenced.
diff --git a/core/modules/filter/lib/Drupal/filter/Plugin/Filter/FilterHtmlImageSecure.php b/core/modules/filter/lib/Drupal/filter/Plugin/Filter/FilterHtmlImageSecure.php
index f00b055..07ca2d2 100644
--- a/core/modules/filter/lib/Drupal/filter/Plugin/Filter/FilterHtmlImageSecure.php
+++ b/core/modules/filter/lib/Drupal/filter/Plugin/Filter/FilterHtmlImageSecure.php
@@ -17,6 +17,10 @@
  *   title = @Translation("Restrict images to this site"),
  *   description = @Translation("Disallows usage of <img> tag sources that are not hosted on this site by replacing them with a placeholder image."),
  *   type = Drupal\filter\Plugin\FilterInterface::TYPE_TRANSFORM_IRREVERSIBLE,
+ *   settings = {
+ *     "domains" = {
+ *     }
+ *   },
  *   weight = 9
  * )
  */
@@ -25,8 +29,37 @@ class FilterHtmlImageSecure extends FilterBase {
   /**
    * {@inheritdoc}
    */
+  public function settingsForm(array $form, array &$form_state) {
+    $form['domains'] = array(
+      '#type' => 'textarea',
+      '#title' => $this->t('Alternate domains'),
+      '#default_value' => implode("\n", $this->settings['domains']),
+      '#description' => $this->t('If your site reachable from muliple domains, such as example.com and www.example.com, list them one per line.'),
+    );
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setConfiguration(array $configuration) {
+    // Split string value from settings form into whitespace-trimmed array.
+    if (is_string($configuration['settings']['domains'])) {
+      if ($configuration['settings']['domains'] === '') {
+        $configuration['settings']['domains'] = array();
+      }
+      else {
+        $configuration['settings']['domains'] = array_map('trim', preg_split('/(\r\n?|\n)/', $configuration['settings']['domains']));
+      }
+    }
+    return parent::setConfiguration($configuration);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   public function process($text, $langcode, $cache, $cache_id) {
-    return _filter_html_image_secure_process($text);
+    return _filter_html_image_secure_process($text, $this->settings['domains']);
   }
 
   /**