diff --git a/manual_trading_hub/.env.example b/manual_trading_hub/.env.example
index c078af8..cd33371 100644
--- a/manual_trading_hub/.env.example
+++ b/manual_trading_hub/.env.example
@@ -23,8 +23,9 @@ HUB_DISABLED_IDS=
 # true=允许 RFC1918 私网访问中控页面;false=仅 127.0.0.1(反代须指向 127.0.0.1:5100)
 HUB_TRUST_LAN=true
 
-# 云服务器用域名/HTTPS 反代访问中控时设为 true(否则公网可能看到 {"detail":"forbidden"})
-# HUB_ALLOW_PUBLIC=true
+# 默认 true(代码默认允许公网/反代访问中控,靠 HUB_PASSWORD 保护)
+# 仅本机调试可关: HUB_ALLOW_PUBLIC=false
+HUB_ALLOW_PUBLIC=true
 
 # 中控 Web 登录(默认 admin / admin123;生产环境请在 .env 中修改)
 HUB_USERNAME=admin
diff --git a/manual_trading_hub/hub.py b/manual_trading_hub/hub.py
index 46cbe6f..8879b88 100644
--- a/manual_trading_hub/hub.py
+++ b/manual_trading_hub/hub.py
@@ -187,9 +187,9 @@ HUB_PORT = int(os.getenv("HUB_PORT", "5100"))
 HUB_BRIDGE_TOKEN = (os.getenv("HUB_BRIDGE_TOKEN") or os.getenv("CONTROL_TOKEN") or "").strip()
 _trust_raw = (os.getenv("HUB_TRUST_LAN", "true") or "").strip().lower()
 HUB_TRUST_LAN = _trust_raw not in ("0", "false", "no", "off")
-_allow_pub_raw = (os.getenv("HUB_ALLOW_PUBLIC") or "").strip().lower()
-# 云服务器 + 域名反代时设为 true:不做 IP 限制,仅靠 HUB_PASSWORD / 登录页保护
-HUB_ALLOW_PUBLIC = _allow_pub_raw in ("1", "true", "yes", "on")
+# 默认 true:云端域名/反代可访问;仅靠 HUB_PASSWORD 保护.本地若要强制仅本机,设 HUB_ALLOW_PUBLIC=false
+_allow_pub_raw = (os.getenv("HUB_ALLOW_PUBLIC", "true") or "").strip().lower()
+HUB_ALLOW_PUBLIC = _allow_pub_raw not in ("0", "false", "no", "off")
 DIR = Path(__file__).resolve().parent
 HUB_BUILD = "20260607-hub-archive"
 _archive_sync_stop: asyncio.Event | None = None
diff --git a/manual_trading_hub/static/login.html b/manual_trading_hub/static/login.html
index 1ec3276..5686d0d 100644
--- a/manual_trading_hub/static/login.html
+++ b/manual_trading_hub/static/login.html
@@ -146,7 +146,7 @@
             return;
           }
           if (r.status === 403) {
-            showErr("访问被拒绝(403):云端 hub 需设置 HUB_ALLOW_PUBLIC=true");
+            showErr("访问被拒绝(403):请确认 HUB_ALLOW_PUBLIC 未设为 false,并检查反代/登录配置");
           } else {
             showErr(j.detail || j.msg || "用户名或密码错误 (" + r.status + ")");
           }