diff --git a/lib/Controller/ExAppProxyController.php b/lib/Controller/ExAppProxyController.php
index bd653857..207dd730 100644
--- a/lib/Controller/ExAppProxyController.php
+++ b/lib/Controller/ExAppProxyController.php
@@ -243,6 +243,14 @@ private function prepareProxy(
 			);
 			return null;
 		}
+		// As the ExApp may read it: cut at "?" or "#", decoded once, any case, surrounding slashes and newlines.
+		$target = rawurldecode(substr($other, 0, strcspn($other, '?#')));
+		if (in_array(strtolower(trim($target, "/\n")), ['heartbeat', 'init', 'enabled'], true)) {
+			$this->logger->debug(
+				sprintf('Returning status 404 for "%s": only AppAPI calls this ExApp endpoint.', $other)
+			);
+			return null;
+		}
 		$exApp = $this->exAppService->getExApp($appId);
 		if ($exApp === null) {
 			$this->logger->debug(