diff --git a/public/index.php b/public/index.php
index 7e6f0041..c4b86f3e 100644
--- a/public/index.php
+++ b/public/index.php
@@ -38,26 +38,26 @@ if($msz->routingCtx->domainRoles->hasRole($request->getHeaderLine('Host'), 'main
     if(str_starts_with($mszLegacyPath, $mszLegacyPathPrefix)) {
         $mszLegacyPathReal = realpath($mszLegacyPath);
         if($mszLegacyPath === $mszLegacyPathReal || $mszLegacyPath === $mszLegacyPathReal . '/') {
-            // this is here so filters can run...
-            $msz->routingCtx->router->route(RouteInfo::exact(
-                $request->method,
-                $request->requestTarget,
-                #[Before('authz:cookie')]
-                function() use ($msz, $mszRequestPath) {
-                    if(str_starts_with($mszRequestPath, 'manage') && !$msz->hasManageAccess())
-                        return 403;
-                },
-            ));
-            $response = $msz->routingCtx->router->handle($request);
-            if($response->getBody()->getSize() > 0) {
-                Router::output($response);
-                exit;
-            }
-
             if(is_dir($mszLegacyPath))
                 $mszLegacyPath .= '/index.php';
 
             if(is_file($mszLegacyPath)) {
+                // this is here so filters can run...
+                $msz->routingCtx->router->route(RouteInfo::exact(
+                    $request->method,
+                    $request->requestTarget,
+                    #[Before('authz:cookie')]
+                    function() use ($msz, $mszRequestPath) {
+                        if(str_starts_with($mszRequestPath, 'manage') && !$msz->hasManageAccess())
+                            return 403;
+                    },
+                ));
+                $response = $msz->routingCtx->router->handle($request);
+                if($response->getBody()->getSize() > 0) {
+                    Router::output($response);
+                    exit;
+                }
+
                 // Reconstruct $_POST since PHP no longer makes it for us
                 if($request->getBody()->isReadable() && empty($_POST)) {
                     $mszRequestContent = (function($contentType, $stream) {