diff --git a/internal/web/accesslists.go b/internal/web/accesslists.go
index 2e2f465..7ba9bd9 100644
--- a/internal/web/accesslists.go
+++ b/internal/web/accesslists.go
@@ -25,7 +25,7 @@ func (h *Web) handleAccessListsList(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Web) handleAccessListForm(w http.ResponseWriter, r *http.Request) {
-	var l models.AccessList
+	l := models.AccessList{DefaultAllow: true}
 	isNew := true
 	if idStr := r.PathValue("id"); idStr != "" {
 		isNew = false
diff --git a/internal/web/templates/access_list_form.html b/internal/web/templates/access_list_form.html
index 1d00cb5..b2fb119 100644
--- a/internal/web/templates/access_list_form.html
+++ b/internal/web/templates/access_list_form.html
@@ -11,7 +11,7 @@
     <div class="col-md-3 d-flex align-items-end">
       <div class="form-check form-switch">
         <input class="form-check-input" type="checkbox" name="default_allow" id="da" {{if $l.DefaultAllow}}checked{{end}}>
-        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed)</label>
+        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed) &mdash; leave this checked if you only want Basic Auth below and no IP restriction</label>
       </div>
     </div>
     <div class="col-12">