diff --git a/src/node/hooks/express/webaccess.js b/src/node/hooks/express/webaccess.js
index 51d57ae2e9f..5ff957a5289 100644
--- a/src/node/hooks/express/webaccess.js
+++ b/src/node/hooks/express/webaccess.js
@@ -10,12 +10,20 @@ const readOnlyManager = require('../../db/ReadOnlyManager');
 hooks.deprecationNotices.authFailure = 'use the authnFailure and authzFailure hooks instead';
 
 const staticPathsRE = new RegExp(`^/(?:${[
-  'api/.*',
+  'api(?:/.*)?',
   'favicon\\.ico',
+  'ep/pad/connection-diagnostic-info',
+  'javascript',
   'javascripts/.*',
+  'jserror/?',
   'locales\\.json',
+  'locales/.*',
+  'rest/.*',
   'pluginfw/.*',
+  'robots.txt',
   'static/.*',
+  'stats/?',
+  'tests/frontend(?:/.*)?'
 ].join('|')})$`);
 
 exports.normalizeAuthzLevel = (level) => {