diff --git a/lib/core-net/vhost.c b/lib/core-net/vhost.c
index 8b8336ea6..095f6acb9 100644
--- a/lib/core-net/vhost.c
+++ b/lib/core-net/vhost.c
@@ -400,15 +400,20 @@ lws_protocol_init_vhost(struct lws_vhost *vh, int *any)
 				}
 				pvo = pvo->next;
 			}
-
-			pvo = pvo1->options;
-		}
+		} else
+			lwsl_debug("%s: not instantiating %s.%s\n",
+				   __func__, vh->name, vh->protocols[n].name);
 
 #if defined(LWS_WITH_TLS)
 		if (any)
 			*any |= !!vh->tls.ssl_ctx;
 #endif
 
+		plwsa->vhost = vh;
+		plwsa->protocol = &vh->protocols[n];
+
+		pvo = lws_vhost_protocol_options(vh, vh->protocols[n].name);
+
 		/*
 		 * inform all the protocols that they are doing their
 		 * one-time initialization if they want to.
@@ -416,17 +421,22 @@ lws_protocol_init_vhost(struct lws_vhost *vh, int *any)
 		 * NOTE the fakewsi is garbage, except the key pointers that are
 		 * prepared in case the protocol handler wants to touch them
 		 */
-		if (vh->protocols[n].callback((struct lws *)plwsa,
+
+		if (pvo || !vh->pvo) {
+			lwsl_info("%s: init %s.%s\n", __func__, vh->name,
+					vh->protocols[n].name);
+			if (vh->protocols[n].callback((struct lws *)plwsa,
 				LWS_CALLBACK_PROTOCOL_INIT, NULL,
-				(void *)pvo, 0)) {
-			if (vh->protocol_vh_privs && vh->protocol_vh_privs[n]) {
-				lws_free(vh->protocol_vh_privs[n]);
-				vh->protocol_vh_privs[n] = NULL;
-			}
+				(void *)(pvo ? pvo->options : NULL), 0)) {
+				if (vh->protocol_vh_privs && vh->protocol_vh_privs[n]) {
+					lws_free(vh->protocol_vh_privs[n]);
+					vh->protocol_vh_privs[n] = NULL;
+				}
 			lwsl_err("%s: protocol %s failed init\n",
 				 __func__, vh->protocols[n].name);
 
-			return 1;
+				return 1;
+			}
 		}
 	}
 
diff --git a/plugins/protocol_lws_status.c b/plugins/protocol_lws_status.c
index ca4603a97..03a6dc6fb 100644
--- a/plugins/protocol_lws_status.c
+++ b/plugins/protocol_lws_status.c
@@ -102,8 +102,10 @@ callback_lws_status(struct lws *wsi, enum lws_callback_reasons reason,
 		vhd = lws_protocol_vh_priv_zalloc(lws_get_vhost(wsi),
 				lws_get_protocol(wsi),
 				sizeof(struct per_vhost_data__lws_status));
-		if (!vhd)
+		if (!vhd) {
+			lwsl_notice("%s: PROTOCOL_INIT failed\n", __func__);
 			return 0;
+		}
 		vhd->context = lws_get_context(wsi);
 		vhd->protocol = lws_get_protocol(wsi);
 		vhd->vhost = lws_get_vhost(wsi);
diff --git a/test-apps/test-server.c b/test-apps/test-server.c
index 872c0a8b7..2272fb5f3 100644
--- a/test-apps/test-server.c
+++ b/test-apps/test-server.c
@@ -348,11 +348,37 @@ static const struct lws_protocol_vhost_options pvo_options = {
 	(void *)&test_options	/* pvo value */
 };
 
-static const struct lws_protocol_vhost_options pvo = {
-	NULL,				/* "next" pvo linked-list */
-	&pvo_options,		/* "child" pvo linked-list */
-	"dumb-increment-protocol",	/* protocol name we belong to on this vhost */
-	""				/* ignored */
+/*
+ * If we don't give any pvos, then for backwards compatibility all protocols
+ * are enabled on all vhosts.  If we give any pvos, then we must list in them
+ * the protocol names we want to enable, protocols that are not listed in the
+ * pvos are not instantiated on the vhost then.
+ */
+
+static const struct lws_protocol_vhost_options
+	pvo3 = {
+		NULL,				/* "next" pvo linked-list */
+		NULL,
+		"protocol-post-demo",	/* protocol name we belong to on this vhost */
+		""				/* not needed */
+	},
+	pvo2 = {
+		&pvo3,				/* "next" pvo linked-list */
+		NULL,
+		"lws-status",	/* protocol name we belong to on this vhost */
+		""				/* not needed */
+	},
+	pvo1 = {
+		&pvo2,				/* "next" pvo linked-list */
+		NULL,
+		"lws-mirror-protocol",	/* protocol name we belong to on this vhost */
+		""				/* not needed */
+	},
+	pvo = {
+		&pvo1,				/* "next" pvo linked-list */
+		&pvo_options,		/* "child" pvo linked-list */
+		"dumb-increment-protocol",	/* protocol name we belong to on this vhost */
+		""				/* not needed */
 };
 
 #if defined(LWS_HAS_GETOPT_LONG) || defined(WIN32)