diff --git a/docker/haproxy.cfg b/docker/haproxy.cfg
index 7f98958..ce78381 100644
--- a/docker/haproxy.cfg
+++ b/docker/haproxy.cfg
@@ -26,6 +26,11 @@ frontend http
     acl certbot path_beg /.well-known/acme-challenge/
     use_backend certbot if certbot
 
+#    # Fool-proof: MS has no auth — never expose /ms publicly.
+#    acl is_ms path -i /ms
+#    acl is_ms path_beg -i /ms/
+#    http-request deny deny_status 404 if is_ms
+
 frontend https
     bind *:443 ssl crt /usr/local/etc/haproxy/certificates/site.pem
     http-request add-header X-Forwarded-Proto https
@@ -34,6 +39,11 @@ frontend https
     acl certbot path_beg /.well-known/acme-challenge/
     use_backend certbot if certbot
 
+#    # Fool-proof: MS has no auth — never expose /ms publicly.
+#    acl is_ms path -i /ms
+#    acl is_ms path_beg -i /ms/
+#    http-request deny deny_status 404 if is_ms
+
 backend default-backend-http
     http-request set-header X-Forwarded-Proto https if { ssl_fc }
     server main nginx:80 check