diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index e57dbe2..0ccc0f1 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -6,8 +6,10 @@
 }
 
 {$CADDY_BASE_HOST} {
+  @blocked not remote_ip {$CADDY_ALLOWED_IPS}
   route {
     crowdsec
+    respond @blocked "<h1>Access Denied</h1>" 403
   }
   encode zstd gzip
   reverse_proxy http://frontend:3000