diff --git a/instances/tests/test_vm_states.py b/instances/tests/test_vm_states.py
index 41771b24..c1b365b7 100644
--- a/instances/tests/test_vm_states.py
+++ b/instances/tests/test_vm_states.py
@@ -54,6 +54,9 @@ class VmStatesTestCase(TestCase):
         stranger = get_user_model().objects.create_user("st-stranger", password="pw")
         self.assertEqual(self.get(stranger).json()["computes"], {})
 
+    def test_a_host_id_that_is_not_a_number_is_not_found(self):
+        self.assertEqual(self.get(self.admin, "?compute=x").status_code, 404)
+
     def test_one_host_s_list_is_for_administrators(self):
         self.assertEqual(self.get(self.admin, f"?compute={self.up.pk}").json()["computes"],
                          {str(self.up.pk): {"ok": True, "vms": UP}})
diff --git a/instances/views.py b/instances/views.py
index f2f92a38..cb21f25a 100755
--- a/instances/views.py
+++ b/instances/views.py
@@ -126,10 +126,12 @@ def states(request):
     """The VM lists' poll: utils.vm_states of the list's hosts; ?compute=id
     for one host's list (administrators)."""
     computes = list(Compute.objects.all())
-    if request.GET.get("compute"):
+    if compute := request.GET.get("compute"):
         if not request.user.is_superuser:
             raise PermissionDenied
-        computes = [get_object_or_404(Compute, pk=request.GET["compute"])]
+        if not compute.isdigit():
+            raise Http404
+        computes = [get_object_or_404(Compute, pk=compute)]
     response = JsonResponse({"computes": utils.vm_states(request.user, _listed_computes(request.user, computes))})
     response["Cache-Control"] = "no-store"
     return response