Switch to only allowing access from the frontend, see how that does.