diff --git a/src/WebApi_prometheus.cpp b/src/WebApi_prometheus.cpp
index 3decacf6..6178f533 100644
--- a/src/WebApi_prometheus.cpp
+++ b/src/WebApi_prometheus.cpp
@@ -25,6 +25,10 @@ void WebApiPrometheusClass::loop()
 
 void WebApiPrometheusClass::onPrometheusMetricsGet(AsyncWebServerRequest* request)
 {
+    if (!WebApi.checkCredentialsReadonly(request)) {
+        return;
+    }
+
     try {
         auto stream = request->beginResponseStream("text/plain; charset=utf-8", 40960);