Disallow external access to vhost by default