The server-status page in apache (look in httpd.conf) is very useful to see how your site is running.
But this is not a page you want available to the world.
Apache will tell you to use the standard Allow/Deny system to control access. I find it easier simply to edit the service in httpd.conf to be:
<Location /server-status-notsayingwhatishere>
So I can get to the service from anywhere.
