diff --git a/cookbooks/fb_apache/attributes/default.rb b/cookbooks/fb_apache/attributes/default.rb
index 14cb1ce2..ae3f4789 100644
--- a/cookbooks/fb_apache/attributes/default.rb
+++ b/cookbooks/fb_apache/attributes/default.rb
@@ -185,3 +185,5 @@
   },
   'mpm' => 'prefork',
 }
+
+node.default['fb_apache']['allow_restart'] = true
diff --git a/cookbooks/fb_apache/recipes/default.rb b/cookbooks/fb_apache/recipes/default.rb
index 1b79716d..a9603aaf 100644
--- a/cookbooks/fb_apache/recipes/default.rb
+++ b/cookbooks/fb_apache/recipes/default.rb
@@ -224,7 +224,13 @@
   end
 end
 
+service 'apache_enable' do
+  service_name svc
+  action [:enable]
+end
+
 service 'apache' do
   service_name svc
-  action [:enable, :start]
+  only_if { node['fb_apache']['allow_restart'] }
+  action [:nothing]
 end
diff --git a/cookbooks/fb_apache/templates/default/status.erb b/cookbooks/fb_apache/templates/default/status.erb
index f741756e..b8e1c5c5 100644
--- a/cookbooks/fb_apache/templates/default/status.erb
+++ b/cookbooks/fb_apache/templates/default/status.erb
@@ -1,3 +1,11 @@
-<Location "<%= @location %>">
+<Location /server-status>
     SetHandler server-status
+    Require local
+    # vpn users
+    Require ip 10.96.244.0/22
+    # vpn users
+    Require ip 10.100.240.0/22
+    # GCP vpn users
+    Require ip 10.0.0.0/8
+    Require ip 127.0.0.1
 </Location>