diff --git a/config/config.go b/config/config.go
index e8574aa..59b23cf 100644
--- a/config/config.go
+++ b/config/config.go
@@ -52,10 +52,9 @@ func Defaults() *Server {
 		hostname = "localhost"
 	}
 	return &Server{
-		Hostname:       hostname,
-		SQLDriver:      "sqlite3",
-		SQLSource:      "soju.db",
-		AcceptProxyIPs: loopbackIPs,
+		Hostname:  hostname,
+		SQLDriver: "sqlite3",
+		SQLSource: "soju.db",
 	}
 }
 
@@ -100,6 +99,10 @@ func parse(cfg scfg.Block) (*Server, error) {
 		case "accept-proxy-ip":
 			srv.AcceptProxyIPs = nil
 			for _, s := range d.Params {
+				if s == "localhost" {
+					srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, loopbackIPs...)
+					continue
+				}
 				_, n, err := net.ParseCIDR(s)
 				if err != nil {
 					return nil, fmt.Errorf("directive %q: failed to parse CIDR: %v", d.Name, err)
diff --git a/doc/soju.1.scd b/doc/soju.1.scd
index 5dd98b7..133ff66 100644
--- a/doc/soju.1.scd
+++ b/doc/soju.1.scd
@@ -114,8 +114,8 @@ The following directives are supported:
 *accept-proxy-ip* <cidr...>
 	Allow the specified IPs to act as a proxy. Proxys have the ability to
 	overwrite the remote and local connection addresses (via the X-Forwarded-\*
-	HTTP header fields). By default, the loopback addresses 127.0.0.0/8 and
-	::1/128 are accepted.
+	HTTP header fields). The special name "localhost" accepts the loopback
+	addresses 127.0.0.0/8 and ::1/128. By default, all IPs are rejected.
 
 # IRC SERVICE