If you want to limit the users who can view the perfdump statistics for your server from a browser you need to create an ACL for the /.perf URI .
The ACL file must also be referenced in the perf object definition in the obj.conf file. For example, if you created a named ACL for the /.perf URI, you would need to reference the ACL file in a PathCheck statement in the object definition as follows:
<Object name="perf">
PathCheck fn="check-acl" acl="perf.acl"
Service fn="service-dump"
</Object>