When installing web deploy DO NOT install the Remote Agent Service!
If you do, it will listen unsecured on public port 80 on the server, locked down only by username/password.
It listens at:
If it is running you can browse to that URL and it will ask for username/password. If this happens you should do a Change install and remove the remote agent service, or disable it!