Preventing accidental public access to Weblate instances

When deploying Weblate in a private environment, the goal is to ensure the application is not unintentionally exposed to the public internet or open to anonymous user registration.

Standard security practices involve using a reverse proxy for authentication and setting DEBUG=False. However, there is uncertainty regarding the most effective combination of internal settings and network configurations to prevent accidental exposure if the host firewall is misconfigured.

Specifically, while REGISTRATION_OPEN=False prevents new account creation, it does not restrict access to the login page or public translation views if the port is exposed.

• Which combination of ALLOWED_HOSTS and reverse proxy configurations provides the strongest protection against direct port access?
• Does disabling registration fully mitigate the risk of search engine indexing for internal instances?