diff --git a/config/config.go b/config/config.go
index 3c52f6c..39e3983 100644
--- a/config/config.go
+++ b/config/config.go
@@ -123,7 +123,7 @@ type Listener struct {
 	AccountHTTP struct {
 		Enabled bool
 		Port    int `sconf:"optional" sconf-doc:"Default 80."`
-	} `sconf:"optional" sconf-doc:"Account web interface, for email users wanting to change their accounts, e.g. set new password, set new delivery rulesets."`
+	} `sconf:"optional" sconf-doc:"Account web interface, for email users wanting to change their accounts, e.g. set new password, set new delivery rulesets. Served at /."`
 	AccountHTTPS struct {
 		Enabled bool
 		Port    int `sconf:"optional" sconf-doc:"Default 80."`
@@ -131,7 +131,7 @@ type Listener struct {
 	AdminHTTP struct {
 		Enabled bool
 		Port    int `sconf:"optional" sconf-doc:"Default 80."`
-	} `sconf:"optional" sconf-doc:"Admin web interface, for managing domains, accounts, etc. Served at /admin/. Preferrably only enable on non-public IPs."`
+	} `sconf:"optional" sconf-doc:"Admin web interface, for managing domains, accounts, etc. Served at /admin/. Preferrably only enable on non-public IPs. Hint: use 'ssh -L 8080:localhost:80 you@yourmachine' and open http://localhost:8080/admin/, or set up a tunnel (e.g. WireGuard) and add its IP to the mox 'internal' listener."`
 	AdminHTTPS struct {
 		Enabled bool
 		Port    int `sconf:"optional" sconf-doc:"Default 443."`
diff --git a/config/doc.go b/config/doc.go
index 0dedf1e..bf85532 100644
--- a/config/doc.go
+++ b/config/doc.go
@@ -193,7 +193,7 @@ describe-static" and "mox config describe-domains":
 				Port: 0
 
 			# Account web interface, for email users wanting to change their accounts, e.g.
-			# set new password, set new delivery rulesets. (optional)
+			# set new password, set new delivery rulesets. Served at /. (optional)
 			AccountHTTP:
 				Enabled: false
 
@@ -208,7 +208,9 @@ describe-static" and "mox config describe-domains":
 				Port: 0
 
 			# Admin web interface, for managing domains, accounts, etc. Served at /admin/.
-			# Preferrably only enable on non-public IPs. (optional)
+			# Preferrably only enable on non-public IPs. Hint: use 'ssh -L 8080:localhost:80
+			# you@yourmachine' and open http://localhost:8080/admin/, or set up a tunnel (e.g.
+			# WireGuard) and add its IP to the mox 'internal' listener. (optional)
 			AdminHTTP:
 				Enabled: false