Logstash HTTP input listening on all interfaces without authentication

When using the Logstash HTTP input plugin, the administrator wants to verify that the endpoint is not reachable from untrusted networks.

The plugin binds to 0.0.0.0 by default and does not require authentication unless ssl or user/password options are explicitly set, leaving the pipeline open to anyone who can reach the port.

In environments where the host setting is omitted or security features are not enabled, it is unclear whether existing firewall rules or container networking adequately restrict access.

What configuration changes guarantee that the HTTP input only accepts connections from trusted interfaces?
How can one confirm that authentication or TLS is active without altering the pipeline?
Is there a recommended approach to bind the plugin to a specific address while preserving existing log ingestion flows?