diff --git a/src/node/db/SecurityManager.ts b/src/node/db/SecurityManager.ts
index 6fb4793a5..33996c155 100644
--- a/src/node/db/SecurityManager.ts
+++ b/src/node/db/SecurityManager.ts
@@ -76,11 +76,11 @@ exports.checkAccess = async (padID:string, sessionCookie:string, token:string, u
 
   // Authentication and authorization checks.
   // settings.loadTest just short-circuits authn/authz; the user-facing
-  // warning about this configuration choice fires once at startup, not
-  // per request (see Settings.ts). Re-logging it here was costing
-  // ~4% of process CPU in the 100-400 author dive sweep (#7756): the
-  // routed-console-warn went through log4js's clustering dispatch on
-  // every message.
+  // warning about this configuration choice is logged from Settings.ts
+  // during settings load/reload, not on every request. Re-logging it
+  // here was costing ~4% of process CPU in the 100-400 author dive
+  // sweep (#7756): the routed-console-warn went through log4js's
+  // clustering dispatch on every message.
   if (!settings.loadTest && settings.requireAuthentication) {
     if (userSettings == null) {
       authLogger.debug('access denied: authentication is required');
diff --git a/src/node/utils/Settings.ts b/src/node/utils/Settings.ts
index e8e6a7983..c603c1320 100644
--- a/src/node/utils/Settings.ts
+++ b/src/node/utils/Settings.ts
@@ -1195,8 +1195,9 @@ export const reloadSettings = () => {
 
     if (settings.loadTest) {
       logger.warn(
-          'settings.loadTest is true: socket.io authentication and authorization checks ' +
-          'will be bypassed for every connection. Do NOT enable this in production.');
+        'settings.loadTest is true: SecurityManager.checkAccess() will bypass ' +
+        'authentication and authorization for both HTTP and socket.io requests. ' +
+        'Do NOT enable this in production.');
     }
 
     if (!settings.skinName) {