diff --git a/Host/Web.Deploy.config b/Host/Web.Deploy.config
index e78eb1c87..0004d8733 100644
--- a/Host/Web.Deploy.config
+++ b/Host/Web.Deploy.config
@@ -432,4 +432,16 @@
 
     <add key="BeWoPlanerServiceRoot" value="C:\BeWoPlaner" />
   </appSettings>
+
+  <location path="status.htm">
+    <system.webServer>
+      <security>
+        <ipSecurity allowUnlisted="false" denyAction="NotFound">
+          <clear />
+          <add ipAddress="127.0.0.1" allowed="true" />
+          <add ipAddress="::1" allowed="true" />
+        </ipSecurity>
+      </security>
+    </system.webServer>
+  </location>
 </configuration>
\ No newline at end of file
diff --git a/Host/Web.config b/Host/Web.config
index c6cf2bdc0..f2a59e82d 100644
--- a/Host/Web.config
+++ b/Host/Web.config
@@ -449,4 +449,17 @@
     <add key="BeWoPlanerServiceRoot" value="C:\BeWoPlaner" />
   </appSettings>
   <!-- <> <> <>  Appsettings <> <> <> -->
+
+  <!-- Serverstatus-Seite nur lokal (Loopback) erreichbar; von außen 404 -->
+  <location path="status.htm">
+    <system.webServer>
+      <security>
+        <ipSecurity allowUnlisted="false" denyAction="NotFound">
+          <clear />
+          <add ipAddress="127.0.0.1" allowed="true" />
+          <add ipAddress="::1" allowed="true" />
+        </ipSecurity>
+      </security>
+    </system.webServer>
+  </location>
 </configuration>
\ No newline at end of file
diff --git a/Host/status.htm b/Host/status.htm
index e4a4ccf4c..545ae531f 100644
--- a/Host/status.htm
+++ b/Host/status.htm
@@ -2,6 +2,7 @@
 <html lang="de">
 <head>
     <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <title>BeWo – Serverstatus</title>
     <style>
         body {
@@ -44,6 +45,12 @@
 </head>
 <body>
     <h1>BeWo Serverstatus</h1>
+    <p id="jsprobe" style="background:#ffe08a; padding:6px;">JavaScript wird NICHT ausgeführt (Active Scripting blockiert?)</p>
+    <script type="text/javascript">
+        document.getElementById('jsprobe').innerHTML = 'JavaScript laeuft ✔';
+        document.getElementById('jsprobe').style.background = '#c7f0c7';
+    </script>
+    <p id="error" class="err" style="display:none; white-space:pre-wrap; border:1px solid red; padding:8px; background:#fee;"></p>
     <p>Tenant: <span id="tenant">–</span></p>
     <p>Serverzeit: <span id="time">–</span></p>
     <p>Version: <span id="version">–</span></p>
@@ -55,43 +62,105 @@
         <tbody id="services"></tbody>
     </table>
 
-    <script>
-    function getTenant() {
-            const params = new URLSearchParams(window.location.search);
-            return params.get('Tenant') || '';
+    <script type="text/javascript">
+        // ES5 / IE11-kompatibel: kein fetch, async, Template-Strings, URLSearchParams, Arrow-Funktionen.
+
+        function getParam(name) {
+            var query = window.location.search.substring(1);
+            var pairs = query.split('&');
+            for (var i = 0; i < pairs.length; i++) {
+                var kv = pairs[i].split('=');
+                if (decodeURIComponent(kv[0]) === name) {
+                    return decodeURIComponent((kv[1] || '').replace(/\+/g, ' '));
+                }
+            }
+            return '';
         }
 
-        async function load() {
-            const tenant = getTenant();
-            const url = tenant
-                ? `StatusService.svc/Status?Tenant=${encodeURIComponent(tenant)}`
-                : 'StatusService.svc/Status';
+        function getTenant() {
+            return getParam('tenant');
+        }
 
-            const res = await fetch(url);
-            const data = await res.json();
+        function getKey() {
+            return getParam('key');
+        }
 
-            document.getElementById('tenant').textContent = data.Tenant || '–';
-            document.getElementById('time').textContent = data.ServerTime;
-            document.getElementById('version').textContent = data.Version;
+        function showError(msg) {
+            var err = document.getElementById('error');
+            err.innerHTML = '';
+            err.appendChild(document.createTextNode(msg));
+            err.style.display = 'block';
+        }
 
-            const db = document.getElementById('db');
-            db.textContent = data.DatabaseOk ? '✔ OK' : '✘ Fehler';
+        function esc(value) {
+            var div = document.createElement('div');
+            div.appendChild(document.createTextNode(value == null ? '' : value));
+            return div.innerHTML;
+        }
+
+        function render(data) {
+            document.getElementById('error').style.display = 'none';
+            document.getElementById('tenant').innerHTML = getTenant() || '–';
+            document.getElementById('time').innerHTML = esc(data.ServerTime);
+            document.getElementById('version').innerHTML = esc(data.Version);
+
+            var db = document.getElementById('db');
+            db.innerHTML = data.DatabaseOk ? '&#10004; OK' : '&#10008; Fehler';
             db.className = data.DatabaseOk ? 'ok' : 'err';
 
-            const tbody = document.getElementById('services');
-            tbody.innerHTML = '';
-            for (const svc of data.Services) {
-                const cls = svc.IsOk ? 'ok' : 'err';
-                tbody.innerHTML += `
-              <tr>
-                <td>${svc.Name}</td>
-                <td class="${cls}">${svc.IsOk ? '✔ OK' : '✘ Fehler'}</td>
-                <td>${svc.Message}</td>
-              </tr>`;
+            var services = data.Services || [];
+            var rows = '';
+            for (var i = 0; i < services.length; i++) {
+                var svc = services[i];
+                var cls = svc.IsOk ? 'ok' : 'err';
+                var symbol = svc.IsOk ? '&#10004; OK' : '&#10008; Fehler';
+                rows += '<tr>'
+                    + '<td>' + esc(svc.Name) + '</td>'
+                    + '<td class="' + cls + '">' + symbol + '</td>'
+                    + '<td>' + esc(svc.Message) + '</td>'
+                    + '</tr>';
             }
+            document.getElementById('services').innerHTML = rows;
+        }
+
+        function load() {
+            var tenant = getTenant();
+            var url = 'StatusService.svc/Status';
+            if (tenant) {
+                url += '?Tenant=' + encodeURIComponent(tenant);
+            }
+            // Cache-Buster: IE cached GET-Anfragen sonst aggressiv.
+            url += (url.indexOf('?') >= 0 ? '&' : '?') + '_=' + new Date().getTime();
+
+            var xhr = new XMLHttpRequest();
+            xhr.open('GET', url, true);
+            xhr.setRequestHeader('AppStatusApiKey', getKey());
+            xhr.onreadystatechange = function () {
+                if (xhr.readyState !== 4) {
+                    return;
+                }
+                var raw = xhr.responseText;
+                var data;
+                try {
+                    data = JSON.parse(raw);
+                } catch (e) {
+                    showError('Keine gueltige JSON-Antwort (HTTP ' + xhr.status + '). Antwort: ' + raw);
+                    return;
+                }
+                if ((xhr.status < 200 || xhr.status >= 300) && !data.Services) {
+                    showError('Fehler vom Server (HTTP ' + xhr.status + '): ' + raw);
+                    return;
+                }
+                render(data);
+            };
+            xhr.onerror = function () {
+                showError('Netzwerkfehler beim Aufruf von ' + url);
+            };
+            xhr.send();
         }
 
         load();
-        setInterval(load, 30000); // alle 30 Sek. aktualisieren</script>
+        setInterval(load, 30000); // alle 30 Sek. aktualisieren
+    </script>
 </body>
 </html>
\ No newline at end of file
