diff --git a/docker/caddy/Caddyfile.production b/docker/caddy/Caddyfile.production
index bbb3293..9af403c 100644
--- a/docker/caddy/Caddyfile.production
+++ b/docker/caddy/Caddyfile.production
@@ -10,6 +10,14 @@
 		max_size 32MB
 	}
 
+	# bookstore-core's tests/, vendor/, composer.json/.lock, and
+	# phpunit.xml.dist ship in the repo (and are bind-mounted straight into
+	# this container — see docker-compose.*.yml) so they exist under the
+	# webroot, but nothing about a git-checkout deploy strips them before
+	# they land here. 404 instead of 403 so their existence isn't confirmed.
+	@dev_only path /wp-content/plugins/bookstore-core/tests/* /wp-content/plugins/bookstore-core/vendor/* /wp-content/plugins/bookstore-core/composer.json /wp-content/plugins/bookstore-core/composer.lock /wp-content/plugins/bookstore-core/phpunit.xml*
+	respond @dev_only 404
+
 	php_fastcgi wordpress:9000
 	file_server
 
diff --git a/docker/caddy/Caddyfile.staging b/docker/caddy/Caddyfile.staging
index 1090d81..c3dd553 100644
--- a/docker/caddy/Caddyfile.staging
+++ b/docker/caddy/Caddyfile.staging
@@ -37,6 +37,14 @@
 		max_size 32MB
 	}
 
+	# bookstore-core's tests/, vendor/, composer.json/.lock, and
+	# phpunit.xml.dist ship in the repo (and are bind-mounted straight into
+	# this container — see docker-compose.*.yml) so they exist under the
+	# webroot, but nothing about a git-checkout deploy strips them before
+	# they land here. 404 instead of 403 so their existence isn't confirmed.
+	@dev_only path /wp-content/plugins/bookstore-core/tests/* /wp-content/plugins/bookstore-core/vendor/* /wp-content/plugins/bookstore-core/composer.json /wp-content/plugins/bookstore-core/composer.lock /wp-content/plugins/bookstore-core/phpunit.xml*
+	respond @dev_only 404
+
 	php_fastcgi wordpress:9000
 	file_server
 }