Since this server may run behind a reverse proxy like Nginx, it should be able to bind to localhost only rather than listening to the whole network.
Alex Huang