diff --git a/server/index.ts b/server/index.ts
index a75c801..4baedaf 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -2053,6 +2053,7 @@ for (const mod of getAllModules()) {
 		if (!space || space === "api" || space.includes(".")) return next();
 
 		// Check enabled modules (skip for core rspace module)
+		await loadCommunity(space);
 		const doc = getDocumentData(space);
 		if (mod.id !== "rspace") {
 			if (doc?.meta?.enabledModules && !doc.meta.enabledModules.includes(mod.id)) {
@@ -2730,6 +2731,16 @@ const server = Bun.serve<WSData>({
 				return app.fetch(new Request(rewrittenUrl, req));
 			}
 
+			// Block disabled modules before rewriting — redirect to space root
+			const firstModId = pathSegments[0].toLowerCase();
+			if (firstModId !== "rspace") {
+				await loadCommunity(subdomain);
+				const spaceDoc = getDocumentData(subdomain);
+				if (spaceDoc?.meta?.enabledModules && !spaceDoc.meta.enabledModules.includes(firstModId)) {
+					return Response.redirect(`https://${subdomain}.rspace.online/`, 302);
+				}
+			}
+
 			// Normalize module ID to lowercase (rTrips → rtrips)
 			const normalizedPath = "/" + pathSegments.map((seg, i) =>
 				i === 0 ? seg.toLowerCase() : seg