Hi, i'm running pi hole on a vps that i use as a vpn via wireguard for all my devices.
It's a potential security risk to expose the web interface to the public ip.
You can add a file
/etc/lighttpd/conf-enabled/00-server-bind.conf
with the content
server.bind = "10.200.200.1" #your wireguard interface ip
now the pi hole webinterface will only be reachable through the wireguard tunnel.
Maybe this helps someone 