# Disable web gui and use only apps **URL:** \ **Category:** Help\ **Created:** [January 31, 2023, 7:50pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308 "2023-01-31T19:50:47Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![dexxter00](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dexxter00](https://vaultwarden.discourse.group/u/dexxter00)\ **Post date:** [January 31, 2023, 7:50pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/1 "2023-01-31T19:50:47Z")
Hello! I’m running latest docker image. Traffic to server is proxied through nginx. So far-so good! What I want to do is to disable the web page and use my public domain only with the apps and addons. I have tried to do this by telling nginx to `deny all` on `/` location, but my iOS app has stopped working. Googled a thing or two for Vaultwarden and Bitwarden, but not many results appear. Anyone have any idea? ---
**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\ **Post date:** [January 31, 2023, 7:54pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/2 "2023-01-31T19:54:09Z")
You can disable the web-vault by setting `WEB_VAULT_ENABLED=false` > **[Disabling or overriding the Vault interface hosting](https://github.com/dani-garcia/vaultwarden/wiki/Disabling-or-overriding-the-Vault-interface-hosting)** > > Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden\_rs - dani-garcia/vaultwarden ---
**Author:** ![dexxter00](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dexxter00](https://vaultwarden.discourse.group/u/dexxter00)\ **Post date:** [January 31, 2023, 7:55pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/3 "2023-01-31T19:55:56Z")
Thank you very much for the fast reply! Can I do this without deleting my docker container and creating it again or by the `/admin` page? Also, `.env` file in root of my datadir does not seem to make sense… ---
**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\ **Post date:** [January 31, 2023, 8:16pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/4 "2023-01-31T20:16:53Z")
This is a setting which you need to recreate the container for (in order for the environment variable to take effect) and it cannot be set via the `/admin` page (as it would require at least a restart anyway). The `.env` is relative to the working directory of the vaultwarden process (which would be `/` in the running container). If you don’t provide the environment variables via docker you could mount a file to `/.env`. Cf. [FAQs · dani-garcia/vaultwarden Wiki · GitHub](https://github.com/dani-garcia/vaultwarden/wiki/FAQs#why-does-vaultwarden-say-info-no-env-file-found-even-though-i-provided-one) ---
**Author:** ![dexxter00](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dexxter00](https://vaultwarden.discourse.group/u/dexxter00)\ **Post date:** [January 31, 2023, 8:39pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/5 "2023-01-31T20:39:03Z")
My original idea with nginx was such that I will be able to use it as an ON/OFF switch - turn it off by default and then turn on when needed. Recreating container every time is time consuming and involves downtime, rather than just reloading nginx. ---
**Author:** ![CyberWarden](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/cyberwarden/32/980_2.png) [@CyberWarden](https://vaultwarden.discourse.group/u/CyberWarden)\ **Post date:** [February 11, 2023, 10:00am UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/6 "2023-02-11T10:00:53Z")
Please elaborate why do you want to turn off webvault. I guess you want to secure it that way, but turning web vault off is not a security measure. You vaultwarden is still accessible on the same port trough the internet. You will just see 404: Not Found in a browser when you try to visit your web vault. Nonetheless your Vaultwarden is still there. How else could you connect from you iOS if there will be not any? Turning off just a web page IS NOT a security measure. However consider solutions below: 1. Whitelist on firewall or reverse proxy to allow only trusted IPs, example only from your own country. 2. Deploy Wireguard VPN and access Vaultwarden from internal network only. 3. Configure Fail2Ban to prevent access from anyone after X failed login attempts from his IP address. 4. Use Knock.d - [https://linux.die.net/man/1/knockd](https://linux.die.net/man/1/knockd) - you can keep all your ports closed, but knock.d will add dynamically a firewall rule to allow the connection after receiving proper combination of packets you define. It is really an aweosome tool. It allows to access any services only on demand securely. 5. Configure 2FA for all accounts 6. Dissallow sign ups Please also check and read my comment in this post: > [@How to configure reverse proxy + Basic Auth with Vaultwarden](https://vaultwarden.discourse.group/t/how-to-configure-reverse-proxy-basic-auth-with-vaultwarden/2271/5): > > You might find Authelia useful to you. Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication and single sign-on (SSO) for your applications via a web portal. [image] However there are plenty of easier best practices at all layers of deployment. Firewall - always allow only what is necessary. Block all traffic OUT and IN, then add rules to allow onl… ---
**Author:** ![dexxter00](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dexxter00](https://vaultwarden.discourse.group/u/dexxter00)\ **Post date:** [February 12, 2023, 8:02am UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/7 "2023-02-12T08:02:15Z")
Thank you for your reply! Yes, as a security measure. Because, without extensive research, it’ll be hard for random users/bots to know what’s behind this address. Your recommendations seem useful, thank you! ---
**Author:** ![CyberWarden](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/cyberwarden/32/980_2.png) [@CyberWarden](https://vaultwarden.discourse.group/u/CyberWarden)\ **Post date:** [February 12, 2023, 4:30pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/8 "2023-02-12T16:30:59Z")
It will not stop bots. Your service is still accessible on the same port. It’s like a child who closes their eyes and yells “I am invisible!”. Bots seeking for vaultwarden instance will very likely look just for rocket webserver and your server will respond even if you see 404 in a browser. Do you even know how your apps can authenticate to your vaultwarden while you can’t see the webvault? It is never a shame to learn, but it is a shame to be ignorant. If instructions I have provided are too complicated I will try to rewrite them step-by-step, but do not admin that hiding webvault will secure anything. It’s for your own good, as exposing password menager to the limitless void of internet can be fatal without proper configuration. ---
**Author:** ![dexxter00](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dexxter00](https://vaultwarden.discourse.group/u/dexxter00)\ **Post date:** [February 20, 2023, 7:33pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/9 "2023-02-20T19:33:01Z")
No, your instructions are detailed enough. Some of them are already done. Thank you for your replies, they were really helpful! ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [November 6, 2023, 6:29pm UTC](https://vaultwarden.discourse.group/t/disable-web-gui-and-use-only-apps/2308/11 "2023-11-06T18:29:05Z")
Not really, since the web-vault is static and only communicate with the api, which you need to have open to support all the other clients anyways