Hi again Jack
I've had an odd reply from my hosts which I don't understand (perhaps he fell on the keyboard!). I'll see if I can get to the bottom of it though.
You mentioned though that it's an easy way for malicious users to take down the webserver. Is it advisable to leave this turned off then? From what I can tell Wordpress requires loopback connections to run it's cron process and perform scheduling (along with automatic upgrades of the multisite sites). I know there are ways around it using alternative cron, but I'd prefer not to use this method.
Is there anywhere I can read up on the security implications of HTTP loopback connections?
Thanks again for your help.ps back on itself to upgrade each website on a multisite install, if that makes sense?