This is a follow up to the question I asked yesterday.
According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial VPN provider is insecure, even though I configured Apache to only accept connections from 127.0.0.1:80. So the workaround I came up with is that I will set up a virtual machine that will be disconnected from the Internet (i.e. with disabled network adapter in VirtualBox) and run my server there, and do my VPN browsing in the host OS.
I believe this would prevent the server from being reachable any other way but by my computer, is that true? Is this a good idea?