diff --git a/apps/hosting-service/src/server.ts b/apps/hosting-service/src/server.ts
index db799d1..14d0f56 100644
--- a/apps/hosting-service/src/server.ts
+++ b/apps/hosting-service/src/server.ts
@@ -51,7 +51,8 @@ app.get('/*', async (c) => {
   const hostname = c.req.header('host') || '';
   const hostnameWithoutPort = hostname.split(':')[0] || '';
   const rawPath = url.pathname.replace(/^\//, '');
-  const path = sanitizePath(rawPath);
+  const hasTrailingSlash = rawPath.endsWith('/');
+  const path = hasTrailingSlash ? sanitizePath(rawPath) + '/' : sanitizePath(rawPath);
 
   logger.debug(`Request: host=${hostname} hostnameWithoutPort=${hostnameWithoutPort} path=${path}`, { BASE_HOST });
 
diff --git a/apps/main-app/src/routes/domain.ts b/apps/main-app/src/routes/domain.ts
index 6fd0084..79a60ba 100644
--- a/apps/main-app/src/routes/domain.ts
+++ b/apps/main-app/src/routes/domain.ts
@@ -327,8 +327,22 @@ export const domainRoutes = (client: NodeOAuthClient, cookieSecret: string) =>
 					throw new Error('Domain parameter required');
 				}
 
+				// Verify domain belongs to user
+				const domainLower = normalizeDomain(domain);
+				const info = await isDomainRegistered(domainLower);
+
+				if (!info.registered || info.type !== 'wisp') {
+					set.status = 404
+					throw new Error('Domain not found');
+				}
+
+				if (info.did !== auth.did) {
+					set.status = 403
+					throw new Error('Unauthorized: You do not own this domain');
+				}
+
 				// Update wisp.place domain to point to this site
-				await updateWispDomainSite(domain, siteRkey);
+				await updateWispDomainSite(domainLower, siteRkey);
 
 				return { success: true };
 			} catch (err) {