--- a/mod_http_health/README.md	Fri Nov 03 23:26:57 2023 +0100
+++ b/mod_http_health/README.md	Sun Nov 05 19:22:46 2023 +0100
@@ -12,6 +12,22 @@
 }
 ```
 
+## Access control
+
+By default only access via localhost is allowed. This can be adjusted with `http_health_allow_ips`. The following example shows the default:
+
+```
+http_health_allow_ips = { "::1"; "127.0.0.1" }
+```
+
+Access can also be granted to one IP range via CIDR notation:
+
+```
+http_health_allow_cidr = "172.17.2.0/24"
+```
+
+The default for `http_health_allow_cidr` is empty.
+
 # Details
 
 Adds a `http://your.prosody.example:5280/health` endpoint that returns either HTTP status code 200 when all appears to be good or 500 when any module