Worked really well - until I realised it was breaking a number of sites.
As _everyone_ is writing: this needs an allow list!