diff --git a/CaddyfileDev b/CaddyfileDev
index 7c67617..5036d03 100644
--- a/CaddyfileDev
+++ b/CaddyfileDev
@@ -94,6 +94,14 @@
          file_server
     }
 
+    handle_path /websocket {
+        respond "Access denied" 403
+    }
+
+    handle_path /cdn-cgi/rum {
+        respond "Access denied" 403
+    }
+
     handle_path /graphql/websocket {
         respond "Access denied" 403
     }
diff --git a/CaddyfileProd b/CaddyfileProd
index 683f2f5..0ecbe65 100644
--- a/CaddyfileProd
+++ b/CaddyfileProd
@@ -95,6 +95,14 @@ freedium.cfd {
          file_server
     }
 
+    handle_path /websocket {
+        respond "Access denied" 403
+    }
+
+    handle_path /cdn-cgi/rum {
+        respond "Access denied" 403
+    }
+
     handle_path /graphql/websocket {
         respond "Access denied" 403
     }
diff --git a/scripts/generate_caddy_rules.py b/scripts/generate_caddy_rules.py
index 9b938df..c802791 100644
--- a/scripts/generate_caddy_rules.py
+++ b/scripts/generate_caddy_rules.py
@@ -21,7 +21,7 @@ for file in static_files:
     OUTPUT_RULES.append(file_template)
 
 
-ACCESS_DENIED_PATHS = ["graphql/websocket", "onboarding/*", "wp-*", ".env", "api*", "apple-touch-icon-precomposed.png", "rss.xml", ".git/*", "apple-touch-icon-120x120.png", "apple-touch-icon-120x120-precomposed.png", "apple-touch-icon-152x152.png", "apple-touch-icon-152x152-precomposed.png", ".well-known/*"]
+ACCESS_DENIED_PATHS = ["websocket", "cdn-cgi/rum", "graphql/websocket", "onboarding/*", "wp-*", ".env", "api*", "apple-touch-icon-precomposed.png", "rss.xml", ".git/*", "apple-touch-icon-120x120.png", "apple-touch-icon-120x120-precomposed.png", "apple-touch-icon-152x152.png", "apple-touch-icon-152x152-precomposed.png", ".well-known/*"]
 
 access_denied_paths_template = """
     handle_path /{{ file }} {