diff --git a/lib/context.c b/lib/context.c
index 26f0268f7d1aee41c6fba4ff19fe0d4d5d0baf63..41b2fba6d569629b10a3e1a29a22410b42034dfe 100644
--- a/lib/context.c
+++ b/lib/context.c
@@ -156,11 +156,11 @@ lws_protocol_init(struct lws_context *context)
 
 LWS_VISIBLE struct lws_vhost *
 lws_create_vhost(struct lws_context *context,
-		 struct lws_context_creation_info *info,
-		 struct lws_http_mount *mounts)
+		 struct lws_context_creation_info *info)
 {
 	struct lws_vhost *vh = lws_zalloc(sizeof(*vh)),
 			 **vh1 = &context->vhost_list;
+	const struct lws_http_mount *mounts;
 #ifdef LWS_WITH_PLUGINS
 	struct lws_plugin *plugin = context->plugin_list;
 	struct lws_protocols *lwsp;
@@ -236,7 +236,7 @@ lws_create_vhost(struct lws_context *context,
 	vh->same_vh_protocol_list = (struct lws **)
 			lws_zalloc(sizeof(struct lws *) * vh->count_protocols);
 
-	vh->mount_list = mounts;
+	vh->mount_list = info->mounts;
 
 #ifdef LWS_USE_UNIX_SOCK
 	if (LWS_UNIX_SOCK_ENABLED(context)) {
@@ -247,6 +247,7 @@ lws_create_vhost(struct lws_context *context,
 	lwsl_notice("Creating Vhost '%s' port %d, %d protocols\n",
 			vh->name, info->port, vh->count_protocols);
 
+	mounts = info->mounts;
 	while (mounts) {
 		lwsl_notice("   mounting %s%s to %s\n",
 				mount_protocols[mounts->origin_protocol],
@@ -594,7 +595,7 @@ lws_create_context(struct lws_context_creation_info *info)
 	 * compatibly and make a default vhost using the data in the info
 	 */
 	if (!lws_check_opt(info->options, LWS_SERVER_OPTION_EXPLICIT_VHOSTS))
-		if (!lws_create_vhost(context, info, NULL)) {
+		if (!lws_create_vhost(context, info)) {
 			lwsl_err("Failed to create default vhost\n");
 			return NULL;
 		}
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index 344258ac4fdf7327ff673548b192a514095898ac..6f86d1c6bc05ff4b8c923e2b6966bb34943e5a19 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -2393,7 +2393,7 @@ lws_json_dump_vhost(const struct lws_vhost *vh, char *buf, int len)
 	);
 
 	if (vh->mount_list) {
-		struct lws_http_mount *m = vh->mount_list;
+		const struct lws_http_mount *m = vh->mount_list;
 
 		buf += snprintf(buf, end - buf, ",\n \"mounts\":[");
 		while (m) {
diff --git a/lib/libwebsockets.h b/lib/libwebsockets.h
index 3aa0702ddf68b9b2acdd5582a1bfda580f5354d2..41c4c9065ff495af12cae4ec0374ee2ef8267450 100644
--- a/lib/libwebsockets.h
+++ b/lib/libwebsockets.h
@@ -1407,74 +1407,88 @@ struct lws_http_mount {
  * If LWS_SERVER_OPTION_EXPLICIT_VHOSTS is given, then no vhosts are created
  * at the same time as the context, they are expected to be created afterwards.
  *
- * @port:	Port to listen on... you can use CONTEXT_PORT_NO_LISTEN to
+ * @port:	VHOST: Port to listen on... you can use CONTEXT_PORT_NO_LISTEN to
  *		suppress listening on any port, that's what you want if you are
  *		not running a websocket server at all but just using it as a
  *		client
- * @iface:	NULL to bind the listen socket to all interfaces, or the
+ * @iface:	VHOST: NULL to bind the listen socket to all interfaces, or the
  *		interface name, eg, "eth2"
  *		If options specifies LWS_SERVER_OPTION_UNIX_SOCK, this member is
  *		the pathname of a UNIX domain socket. you can use the UNIX domain
  *		sockets in abstract namespace, by prepending an @ symbole to the
  *		socket name.
- * @protocols:	Array of structures listing supported protocols and a protocol-
+ * @protocols:	VHOST: Array of structures listing supported protocols and a protocol-
  *		specific callback for each one.  The list is ended with an
  *		entry that has a NULL callback pointer.
  *		It's not const because we write the owning_server member
- * @extensions: NULL or array of lws_extension structs listing the
+ * @extensions: VHOST: NULL or array of lws_extension structs listing the
  *		extensions this context supports.  If you configured with
  *		--without-extensions, you should give NULL here.
- * @token_limits: NULL or struct lws_token_limits pointer which is initialized
+ * @token_limits: CONTEXT: NULL or struct lws_token_limits pointer which is initialized
  *		with a token length limit for each possible WSI_TOKEN_***
- * @ssl_cert_filepath:	If libwebsockets was compiled to use ssl, and you want
+ * @ssl_cert_filepath:	VHOST: If libwebsockets was compiled to use ssl, and you want
  *			to listen using SSL, set to the filepath to fetch the
  *			server cert from, otherwise NULL for unencrypted
- * @ssl_private_key_filepath: filepath to private key if wanting SSL mode;
+ * @ssl_private_key_filepath: VHOST: filepath to private key if wanting SSL mode;
  *			if this is set to NULL but sll_cert_filepath is set, the
  *			OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called
  *			to allow setting of the private key directly via openSSL
  *			library calls
- * @ssl_ca_filepath: CA certificate filepath or NULL
- * @ssl_cipher_list:	List of valid ciphers to use (eg,
+ * @ssl_ca_filepath: VHOST: CA certificate filepath or NULL
+ * @ssl_cipher_list:	VHOST: List of valid ciphers to use (eg,
  * 			"RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL"
  * 			or you can leave it as NULL to get "DEFAULT"
- * @http_proxy_address: If non-NULL, attempts to proxy via the given address.
+ * @http_proxy_address: VHOST: If non-NULL, attempts to proxy via the given address.
  *			If proxy auth is required, use format
  *			"username:password@server:port"
- * @http_proxy_port:	If http_proxy_address was non-NULL, uses this port at
+ * @http_proxy_port:	VHOST: If http_proxy_address was non-NULL, uses this port at
  * 			the address
- * @gid:	group id to change to after setting listen socket, or -1.
- * @uid:	user id to change to after setting listen socket, or -1.
- * @options:	0, or LWS_SERVER_OPTION_... bitfields
- * @user:	optional user pointer that can be recovered via the context
+ * @gid:	CONTEXT: group id to change to after setting listen socket, or -1.
+ * @uid:	CONTEXT: user id to change to after setting listen socket, or -1.
+ * @options:	VHOST + CONTEXT: 0, or LWS_SERVER_OPTION_... bitfields
+ * @user:	CONTEXT: optional user pointer that can be recovered via the context
  *		pointer using lws_context_user
- * @ka_time:	0 for no keepalive, otherwise apply this keepalive timeout to
+ * @ka_time:	CONTEXT: 0 for no keepalive, otherwise apply this keepalive timeout to
  *		all libwebsocket sockets, client or server
- * @ka_probes:	if ka_time was nonzero, after the timeout expires how many
+ * @ka_probes:	CONTEXT: if ka_time was nonzero, after the timeout expires how many
  *		times to try to get a response from the peer before giving up
  *		and killing the connection
- * @ka_interval: if ka_time was nonzero, how long to wait before each ka_probes
+ * @ka_interval: CONTEXT: if ka_time was nonzero, how long to wait before each ka_probes
  *		attempt
- * @provided_client_ssl_ctx: If non-null, swap out libwebsockets ssl
+ * @provided_client_ssl_ctx: CONTEXT: If non-null, swap out libwebsockets ssl
  *		implementation for the one provided by provided_ssl_ctx.
  *		Libwebsockets no longer is responsible for freeing the context
  *		if this option is selected.
- * @max_http_header_data: The max amount of header payload that can be handled
+ * @max_http_header_data: CONTEXT: The max amount of header payload that can be handled
  *		in an http request (unrecognized header payload is dropped)
- * @max_http_header_pool: The max number of connections with http headers that
+ * @max_http_header_pool: CONTEXT: The max number of connections with http headers that
  *		can be processed simultaneously (the corresponding memory is
  *		allocated for the lifetime of the context).  If the pool is
  *		busy new incoming connections must wait for accept until one
  *		becomes free.
- * @count_threads: how many contexts to create in an array, 0 = 1
- * @fd_limit_per_thread: nonzero means restrict each service thread to this
+ * @count_threads: CONTEXT: how many contexts to create in an array, 0 = 1
+ * @fd_limit_per_thread: CONTEXT: nonzero means restrict each service thread to this
  *		many fds, 0 means the default which is divide the process fd
  *		limit by the number of threads.
- * @timeout_secs: various processes involving network roundtrips in the
+ * @timeout_secs: VHOST: various processes involving network roundtrips in the
  *		library are protected from hanging forever by timeouts.  If
  *		nonzero, this member lets you set the timeout used in seconds.
  *		Otherwise a default timeout is used.
- * @ecdh_curve: if NULL, defaults to initializing server with "prime256v1"
+ * @ecdh_curve: VHOST: if NULL, defaults to initializing server with "prime256v1"
+ * @vhost_name: VHOST: name of vhost, must match external DNS name used to
+ *		access the site, like "warmcat.com" as it's used to match
+ *		Host: header and / or SNI name for SSL.
+ * @plugins_dir: CONTEXT: directory to scan for lws protocol plugins at
+ *		context creation time
+ * @pvo:	VHOST: pointer to optional linked list of per-vhost
+ *		options made accessible to protocols
+ * @keepalive_timeout: VHOST: (default = 0 = 60s) seconds to allow remote
+ *		client to hold on to an idle HTTP/1.1 connection
+ * @log_filepath: VHOST: filepath to append logs to... this is opened before
+ *		any dropping of initial privileges
+ * @mounts:	VHOST: optional linked list of mounts for this vhost
+ * @server_string: CONTEXT: string used in HTTP headers to identify server
+ *		software, if NULL, "libwebsockets".
  */
 
 struct lws_context_creation_info {
@@ -1482,7 +1496,7 @@ struct lws_context_creation_info {
 	const char *iface;				/* VH */
 	const struct lws_protocols *protocols;		/* VH */
 	const struct lws_extension *extensions;		/* VH */
-	const struct lws_token_limits *token_limits;
+	const struct lws_token_limits *token_limits;	/* context */
 	const char *ssl_private_key_password;		/* VH */
 	const char *ssl_cert_filepath;			/* VH */
 	const char *ssl_private_key_filepath;		/* VH */
@@ -1492,19 +1506,19 @@ struct lws_context_creation_info {
 	unsigned int http_proxy_port;			/* VH */
 	int gid;					/* context */
 	int uid;					/* context */
-	unsigned int options;				/* context */
+	unsigned int options;				/* VH + context */
 	void *user;					/* context */
-	int ka_time;
-	int ka_probes;
-	int ka_interval;
+	int ka_time;					/* context */
+	int ka_probes;					/* context */
+	int ka_interval;				/* context */
 #ifdef LWS_OPENSSL_SUPPORT
-	SSL_CTX *provided_client_ssl_ctx;
+	SSL_CTX *provided_client_ssl_ctx;		/* context */
 #else /* maintain structure layout either way */
 	void *provided_client_ssl_ctx;
 #endif
 
-	short max_http_header_data;
-	short max_http_header_pool;
+	short max_http_header_data;			/* context */
+	short max_http_header_pool;			/* context */
 
 	unsigned int count_threads;			/* context */
 	unsigned int fd_limit_per_thread;		/* context */
@@ -1515,6 +1529,7 @@ struct lws_context_creation_info {
 	struct lws_protocol_vhost_options *pvo;		/* VH */
 	int keepalive_timeout;				/* VH */
 	const char *log_filepath;			/* VH */
+	const struct lws_http_mount *mounts;		/* VH */
 	const char *server_string;			/* context */
 
 	/* Add new things just above here ---^
@@ -1612,8 +1627,7 @@ struct lws_vhost;
 
 LWS_VISIBLE struct lws_vhost *
 lws_create_vhost(struct lws_context *context,
-		 struct lws_context_creation_info *info,
-		 struct lws_http_mount *mounts);
+		 struct lws_context_creation_info *info);
 
 LWS_VISIBLE struct lws_vhost *
 lws_vhost_get(struct lws *wsi);
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index 1a4eed62cc6ed595b0c3a6b1bb61f90251f16c3d..16f435da97c525b390bda93580824981557fc3ee 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -643,7 +643,7 @@ struct lws_vhost {
 	char proxy_basic_auth_token[128];
 	struct lws_context *context;
 	struct lws_vhost *vhost_next;
-	struct lws_http_mount *mount_list;
+	const struct lws_http_mount *mount_list;
 	struct lws *lserv_wsi;
 	const char *name;
 	const char *iface;
diff --git a/lib/server.c b/lib/server.c
index 4edabdd1895c2e92aa7f8488ced3f18c789a8e63..759b5b4cba31a5afe8cede80b8127266225ee507 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -334,7 +334,7 @@ lws_http_action(struct lws *wsi)
 	enum http_connection_type connection_type;
 	enum http_version request_version;
 	char content_length_str[32];
-	struct lws_http_mount *hm, *hit = NULL;
+	const struct lws_http_mount *hm, *hit = NULL;
 	unsigned int n, count = 0;
 	char http_version_str[10];
 	char http_conn_str[20];
diff --git a/lwsws/conf.c b/lwsws/conf.c
index e3a1ada0d3e47b7e449cd4fcfa99dc6db6ffa132..31d38f85f1c2846ab7f2476c43a11b866b62b23c 100644
--- a/lwsws/conf.c
+++ b/lwsws/conf.c
@@ -244,8 +244,9 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 			return 1;
 		}
 		a->valid = 0;
+		a->info->mounts = a->head;
 
-		if (!lws_create_vhost(a->context, a->info, a->head)) {
+		if (!lws_create_vhost(a->context, a->info)) {
 			lwsl_err("Failed to create vhost %s\n",
 				 a->info->vhost_name);
 			return 1;