diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index 34d6cc812e..8d6d69f8f2 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -16,7 +16,7 @@ const safeGet = async <T = any>(key: string): Promise<T | undefined> => {
   }
 };
 
-export const POST_METHODS_ALLOWED_API_ROUTES = ["/api"];
+export const POST_METHODS_ALLOWED_API_ROUTES = ["/api/"]; // trailing slash in "/api/" is actually important to block edge cases like `/api.php`
 // Some app routes are allowed because "revalidatePath()" is used to revalidate the cache for them
 export const POST_METHODS_ALLOWED_APP_ROUTES = ["/settings/my-account/general"];