I sorted it! I had resided to the fact that it wasn't going to work so set about putting on .htaccess:
When that didn't work I thought about it logically. Because I can access via the hostname/ispconfig I changed sites-enabled/000-default to:
Options Indexes FollowSymLinks MultiViews
deny from all
and it worked! Now I can just put some allow hosts in!