protect vhosts