diff --git a/src/backend/src/middleware/abuse.js b/src/backend/src/middleware/abuse.js
index fc22c3b09..dc621edc2 100644
--- a/src/backend/src/middleware/abuse.js
+++ b/src/backend/src/middleware/abuse.js
@@ -19,7 +19,13 @@
 const APIError = require("../api/APIError");
 const { Context } = require("../util/context");
 
+const config = puter.core.config;
+
 const abuse = options => (req, res, next) => {
+    if ( config.disable_abuse_checks ) {
+        next(); return;
+    }
+
     const requester = Context.get('requester');
 
     if ( options.no_bots ) {
diff --git a/src/backend/src/modules/web/WebServerService.js b/src/backend/src/modules/web/WebServerService.js
index 3d0112019..d9c42a204 100644
--- a/src/backend/src/modules/web/WebServerService.js
+++ b/src/backend/src/modules/web/WebServerService.js
@@ -524,7 +524,7 @@ class WebServerService extends BaseService {
             }
 
             // rules that don't apply to notification endpoints
-            const undefined_origin_allowed = this.undefined_origin_allowed.some(rule => {
+            const undefined_origin_allowed = config.undefined_origin_allowed || this.undefined_origin_allowed.some(rule => {
                 if ( typeof rule === 'string' ) return rule === req.path;
                 return rule.test(req.path);
             });