diff --git a/docs/server-client-mode-remote.md b/docs/server-client-mode-remote.md
index e9cae99..f40bf6c 100644
--- a/docs/server-client-mode-remote.md
+++ b/docs/server-client-mode-remote.md
@@ -68,6 +68,9 @@ only the public access is HTTPS.
 For any non-loopback bind, keep the full remote HTTPS configuration:
 `--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`.
 `ServerConfig::validate()` rejects a non-loopback bind without it.
+That check covers the configuration, not reality: it cannot verify that a proxy
+is actually terminating HTTPS in front of the server. Do not expose the backend
+on a public non-loopback address without TLS proxying.
 
 The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`.
 `--public-origin` is matched by strict equality against the request `Origin`: