I have configured mod_status like this in my Apache 2 config file: <Location /server-status> SetHandler server-status Order Deny,Allow </Location> I also tried: Order Deny,Allow allow from all And: Order Allow,Deny allow from all And: Order Deny,Allow Deny from all Allow from 145.xxx.xx.xx And of course I restarted Apache after each configuration change. I tried the configurations above in my main config file and under a VirtualHost directive. When I place the configuration under VirtualHost or in a NameVirtualHost block I get a 404 instead of 403. But I get only get 403 Forbidden when I visit example.com/server-status/ I don't use an .htaccess file. It works now! I placed the server-status code right above the definitions of the virtual hosts. I didn't test the right configuration on the right virtual host. On the virtual host without htaccess files it works, on virtual hosts with an app installed I get 404 because of url rewrites in the htaccess file.