diff --git a/frontends/ycdl_flask/backend/common.py b/frontends/ycdl_flask/backend/common.py
index a9cc291..db5868e 100644
--- a/frontends/ycdl_flask/backend/common.py
+++ b/frontends/ycdl_flask/backend/common.py
@@ -38,9 +38,16 @@ site.jinja_env.trim_blocks = True
 site.jinja_env.lstrip_blocks = True
 jinja_filters.register_all(site)
 site.debug = True
+site.localhost_only = False
 
 ####################################################################################################
 
+@site.before_request
+def before_request():
+    ip = request.remote_addr
+    if site.localhost_only and ip != '127.0.0.1':
+        flask.abort(403)
+
 gzip_minimum_size = 500
 gzip_maximum_size = 5 * 2**20
 gzip_level = 3
diff --git a/frontends/ycdl_flask/ycdl_flask_dev.py b/frontends/ycdl_flask/ycdl_flask_dev.py
index 327fedb..ad7344f 100644
--- a/frontends/ycdl_flask/ycdl_flask_dev.py
+++ b/frontends/ycdl_flask/ycdl_flask_dev.py
@@ -30,7 +30,7 @@ site = backend.site
 
 HTTPS_DIR = pathclass.Path(__file__).parent.with_child('https')
 
-def ycdl_flask_launch(create, port, refresh_rate, use_https):
+def ycdl_flask_launch(create, port, localhost_only, refresh_rate, use_https):
     if use_https is None:
         use_https = port == 443
 
@@ -47,6 +47,9 @@ def ycdl_flask_launch(create, port, refresh_rate, use_https):
             application=site,
         )
 
+    if localhost_only:
+        site.localhost_only = True
+
     youtube_core = ycdl.ytapi.Youtube(bot.get_youtube_key())
     backend.common.init_ycdldb(youtube_core, create=create)
 
@@ -71,6 +74,7 @@ def ycdl_flask_launch_argparse(args):
 
     return ycdl_flask_launch(
         create=args.create,
+        localhost_only=args.localhost_only,
         port=args.port,
         refresh_rate=refresh_rate,
         use_https=args.use_https,
@@ -81,6 +85,7 @@ def main(argv):
 
     parser.add_argument('port', nargs='?', type=int, default=5000)
     parser.add_argument('--dont_create', '--dont-create', '--no-create', dest='create', action='store_false', default=True)
+    parser.add_argument('--localhost_only', '--localhost-only', dest='localhost_only', action='store_true')
     parser.add_argument('--no_refresh', '--no-refresh', dest='do_refresh', action='store_false', default=True)
     parser.add_argument('--refresh_rate', '--refresh-rate', dest='refresh_rate', type=int, default=60 * 60 * 6)
     parser.add_argument('--https', dest='use_https', action='store_true', default=None)