main.go

@@ -574,10 +574,11 @@ func CheckRequest(app *model.AppState, next http.Handler) http.Handler {
             return
         }
 
-        // obviously .php requests these don't affect me, but these tend to be
+        // same with .php and awkward double-slash requests.
-        // lazy wordpress intrusion attempts. if that's what you're about, i
+        // obviously these don't affect me, but these tend to be lazy intrusion
-        // don't want you on my site.
+        // attempts. if that's what you're about, i don't want you on my site.
-        if strings.HasSuffix(r.URL.Path, ".php") ||
+        if strings.HasPrefix(r.URL.Path, "//") ||
+        strings.HasSuffix(r.URL.Path, ".php") ||
         strings.HasSuffix(r.URL.Path, ".php7") {
             http.NotFound(w, r)
             fmt.Fprintf(