diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
index 556d4419f5..07e922dc27 100644
--- a/docs/sample_config.yaml
+++ b/docs/sample_config.yaml
@@ -1393,10 +1393,10 @@ sso:
     # hostname: "https://my.client/".
     #
     # If public_baseurl is set, then the login fallback page (used by clients
-    # that don't have full support for SSO) is always included in this list.
+    # that don't natively support the required login flows) is whitelisted in
+    # addition to any URLs in this list.
     #
-    # By default, this list is empty, except if public_baseurl is set (in which
-    # case the login fallback page is the only element in the list).
+    # By default, this list is empty.
     #
     #client_whitelist:
     #  - https://riot.im/develop
diff --git a/synapse/config/sso.py b/synapse/config/sso.py
index 5ae9db83d0..ec3dca9efc 100644
--- a/synapse/config/sso.py
+++ b/synapse/config/sso.py
@@ -66,10 +66,10 @@ class SSOConfig(Config):
             # hostname: "https://my.client/".
             #
             # If public_baseurl is set, then the login fallback page (used by clients
-            # that don't have full support for SSO) is always included in this list.
+            # that don't natively support the required login flows) is whitelisted in
+            # addition to any URLs in this list.
             #
-            # By default, this list is empty, except if public_baseurl is set (in which
-            # case the login fallback page is the only element in the list).
+            # By default, this list is empty.
             #
             #client_whitelist:
             #  - https://riot.im/develop