diff --git a/server-ce/nginx/sharelatex.conf b/server-ce/nginx/sharelatex.conf
index cc04eb0c77..140ecd5139 100644
--- a/server-ce/nginx/sharelatex.conf
+++ b/server-ce/nginx/sharelatex.conf
@@ -4,6 +4,11 @@ server {
 
 	root /overleaf/services/web/public/;
 
+	# block external access to prometheus /metrics
+	location /metrics {
+		internal;
+	}
+
 	location / {
 		proxy_pass http://127.0.0.1:3000;
 		proxy_http_version 1.1;