diff --git a/root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/100mailstats b/root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/100mailstats
index 1bb42ce..c4d0394 100644
--- a/root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/100mailstats
+++ b/root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/100mailstats
@@ -10,36 +10,39 @@
 	$OUT .="\n";
 	$OUT .= qq(
 	# Alias for mailstats
-	Alias "/mailstats/js" "/opt/mailstats/js"
-	Alias "/mailstats/css" "/opt/mailstats/css"
-	Alias "/mailstats" "/opt/mailstats/html"
+	Alias "/mailstats/js" "/opt/mailstats/js/"
+	Alias "/mailstats/css" "/opt/mailstats/css/"
+	Alias "/mailstats" "/opt/mailstats/html/"
+	);
+	# $httpd_admin{ValidFrom} contains space-separated IPs or CIDRs
+	my $valid_from = ${'httpd-admin'}{ValidFrom} // "";
+	my $require_ip = $localAccess." ".join(" ", split(/[,\s]+/, $valid_from));
+	# Remove any /255.255.255.255 substrings
+	$require_ip =~ s{/255\.255\.255\.255}{}g;
 
+	$OUT .= qq(
 	<Directory "/opt/mailstats/html">
 		Options Indexes FollowSymLinks
 		AllowOverride None
-		Require all granted
-	);
-	$OUT .= (($mailstats{access} || 'private' ) eq "public" ) ?  "      Require all granted": "      Require ip $localAccess $externalSSLAccess";
-	$OUT .= qq(
+		Require ip $require_ip
+
 		<FilesMatch .php\$\>
 			SetHandler "proxy:unix:/var/run/php-fpm/php74.sock|fcgi://localhost"
 		</FilesMatch>
+
 	</Directory>
 
 	<Directory "/opt/mailstats/css">
 		AllowOverride None
-		Require all granted
+		Require ip $require_ip
 	</Directory>
 
 	<Directory "/opt/mailstats/js">
 		AllowOverride None
-		Require all granted
+		Require ip $require_ip
 	</Directory>
 	);
-
-  }
-    else 
-    {
+  } else {
       $OUT .= "# mailstats is disabled";
-    }
-}
\ No newline at end of file
+  }
+}
diff --git a/smeserver-mailstats.spec b/smeserver-mailstats.spec
index 7de9064..3f2ef36 100644
--- a/smeserver-mailstats.spec
+++ b/smeserver-mailstats.spec
@@ -6,7 +6,7 @@ Summary: Daily mail statistics for SME Server
 %define name smeserver-mailstats
 Name: %{name}
 %define version 11.1
-%define release 11
+%define release 12
 %define full_version %{version}.%{release})
 Version: %{version}
 Release: %{release}%{?dist}
@@ -88,6 +88,9 @@ chmod u+s /usr/bin/journalwrap
 /sbin/ldconfig
 
 %changelog
+* Tue Sep 30 2025 Brian Read <brianr@koozali.org> 11.1-12.sme
+- Fix httpd conf fragment and add in ValidFrom Ips [SME: 13204]
+
 * Fri Sep 26 2025 Brian Read <brianr@koozali.org> 11.1-11.sme
 - Fix version number extraction fro supplied string [SME: 13121]