I have configured mod_status like this in my Apache 2 config file:

<Location /server-status>
    SetHandler server-status

    Order Deny,Allow
</Location>

I also tried:

Order Deny,Allow
allow from all

And:

Order Allow,Deny
allow from all

And:

Order Deny,Allow
Deny from all
Allow from 145.xxx.xx.xx

And of course I restarted Apache after each configuration change. I tried the configurations above in my main config file and under a VirtualHost directive.

When I place the configuration under VirtualHost or in a NameVirtualHost block I get a 404 instead of 403.

But I get only get 403 Forbidden when I visit example.com/server-status/

I don't use an .htaccess file.

It works now! I placed the server-status code right above the definitions of the virtual hosts. I didn't test the right configuration on the right virtual host. On the virtual host without htaccess files it works, on virtual hosts with an app installed I get 404 because of url rewrites in the htaccess file.