diff --git a/src/Route/UI/Http/Responses/PublicDirectoryIndexRedirect.php b/src/Route/UI/Http/Responses/PublicDirectoryIndexRedirect.php
index 6a473ce7..c48aab1d 100644
--- a/src/Route/UI/Http/Responses/PublicDirectoryIndexRedirect.php
+++ b/src/Route/UI/Http/Responses/PublicDirectoryIndexRedirect.php
@@ -31,6 +31,12 @@ public static function for(Request $request, string $publicPath): ?RedirectRespo
             return null;
         }
 
+        // The content folders answer the site's 404 on purpose (see the
+        // skeleton's .htaccess): redirecting would tell a visitor they exist
+        if (preg_match('#^/(cms/wp-content|content)(/|$)#', $path) === 1) {
+            return null;
+        }
+
         $root = realpath($publicPath);
         $directory = realpath($publicPath.$path);
 
diff --git a/tests/Unit/Route/PublicDirectoryIndexRedirectTest.php b/tests/Unit/Route/PublicDirectoryIndexRedirectTest.php
index 52a0c113..1d4e14e9 100644
--- a/tests/Unit/Route/PublicDirectoryIndexRedirectTest.php
+++ b/tests/Unit/Route/PublicDirectoryIndexRedirectTest.php
@@ -9,6 +9,10 @@
     $this->public = sys_get_temp_dir().'/pollora-public-'.bin2hex(random_bytes(6));
     mkdir($this->public.'/cms/wp-admin', 0777, true);
     mkdir($this->public.'/cms/empty', 0777, true);
+    mkdir($this->public.'/cms/wp-content/plugins', 0777, true);
+    mkdir($this->public.'/content/plugins', 0777, true);
+    touch($this->public.'/cms/wp-content/plugins/index.php');
+    touch($this->public.'/content/plugins/index.php');
     touch($this->public.'/index.php');
     touch($this->public.'/cms/wp-admin/index.php');
     touch($this->public.'/cms/wp-login.php');
@@ -40,6 +44,8 @@
         'the root' => '/',
         'a WordPress page' => '/sample-page/',
         'outside public' => '/../',
+        'WordPress content folder' => '/cms/wp-content/plugins/',
+        'content folder' => '/content/plugins/',
     ]);
 
     it('only redirects reads', function (): void {