This is on Apache/2.2.21. In httpd.conf, I had the following directive:
<Location /server-status> SetHandler server-status Order deny,allow Deny from all Allow from xx.xx.xxx.xxx <Location>
I realized recently that my own IP address no longer matched the "Allow from", but still I was able to access server-status! In other words, it was somehow set to be completely public. (I have now disabled it.)
How is this possible? The Location directive is global and my sites are served through vhosts.
Also, what is the best way to configure server-status when I am accessing it from a dynamically-assigned IP address?