diff --git a/app/http/controllers/asset_controller.go b/app/http/controllers/asset_controller.go
index 61b206d724..1892ccba66 100644
--- a/app/http/controllers/asset_controller.go
+++ b/app/http/controllers/asset_controller.go
@@ -23,12 +23,24 @@ func NewAssetController() *AssetController {
 
 func (r *AssetController) Index(ctx http.Context) http.Response {
 	entrance := facades.Config().GetString("http.entrance")
-	path := strings.TrimPrefix(ctx.Request().Path(), entrance)
+	if entrance == "/" {
+		entrance = ""
+	}
 
 	// 自动纠正 URL 格式
 	if ctx.Request().Path() == entrance && ctx.Request().Path() != "/" {
 		return ctx.Response().Redirect(http.StatusMovedPermanently, ctx.Request().Path()+"/")
 	}
+	// 拒绝访问非入口文件
+	if !strings.HasPrefix(ctx.Request().Path(), entrance) {
+		return ctx.Response().Status(http.StatusNotFound).String(http.StatusText(http.StatusNotFound))
+	}
+
+	path := strings.TrimPrefix(ctx.Request().Path(), entrance)
+	// 设置默认首页
+	if path == "/" || path == "" {
+		path = "/index.html"
+	}
 
 	if !tools.Exists("public" + path) {
 		return ctx.Response().Status(http.StatusNotFound).String(http.StatusText(http.StatusNotFound))
@@ -52,7 +64,7 @@ func (r *AssetController) Index(ctx http.Context) http.Response {
 }
 
 func (r *AssetController) Favicon(ctx http.Context) http.Response {
-	return ctx.Response().File("public/favicon.ico")
+	return ctx.Response().File("public/favicon.png")
 }
 
 func (r *AssetController) Robots(ctx http.Context) http.Response {
diff --git a/app/providers/route_service_provider.go b/app/providers/route_service_provider.go
index 95684c30f1..d09858cdac 100644
--- a/app/providers/route_service_provider.go
+++ b/app/providers/route_service_provider.go
@@ -20,8 +20,8 @@ func (receiver *RouteServiceProvider) Boot(app foundation.Application) {
 
 	receiver.configureRateLimiting()
 
-	routes.Api()
 	routes.Plugin()
+	routes.Api()
 }
 
 func (receiver *RouteServiceProvider) configureRateLimiting() {
diff --git a/go.mod b/go.mod
index ef49af33c5..c0daf43cbf 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/gookit/color v1.5.4
 	github.com/gookit/validate v1.5.1
 	github.com/goravel/fiber v1.1.11-0.20231108081345-36e967f101d0
-	github.com/goravel/framework v1.13.1-0.20231108041300-502c6154220a
+	github.com/goravel/framework v1.13.1-0.20231109083801-f2c86a7c0796
 	github.com/iancoleman/strcase v0.3.0
 	github.com/imroc/req/v3 v3.42.1
 	github.com/mojocn/base64Captcha v1.3.5
diff --git a/go.sum b/go.sum
index 06793ab98d..6dbfa84f8d 100644
--- a/go.sum
+++ b/go.sum
@@ -385,8 +385,8 @@ github.com/goravel/file-rotatelogs v0.0.0-20211215053220-2ab31dd9575c h1:obhFK91
 github.com/goravel/file-rotatelogs v0.0.0-20211215053220-2ab31dd9575c/go.mod h1:YSWsLXlG16u5CWFaXNZHhEQD10+NwF3xfgDV816OwLE=
 github.com/goravel/file-rotatelogs/v2 v2.4.1 h1:ogkeIFcTHSBRUBpZYiyJbpul8hkVXxHPuDbOaP78O1M=
 github.com/goravel/file-rotatelogs/v2 v2.4.1/go.mod h1:euk9qr52WrzM8ICs1hecFcR4CZ/ZZOPdacHfvHgbOf0=
-github.com/goravel/framework v1.13.1-0.20231108041300-502c6154220a h1:yDoavHw/EIUCWujemzn2DVhW/Fht62FUIvGYd5ZF1rY=
-github.com/goravel/framework v1.13.1-0.20231108041300-502c6154220a/go.mod h1:5jKFbJzfqhaQTP3HCgbyrpnrCyoJjxN5JWSXO96H0iQ=
+github.com/goravel/framework v1.13.1-0.20231109083801-f2c86a7c0796 h1:4ZqUXMfPP8M10joipSdP9PGgDoVD51vZIcCPds/EyGk=
+github.com/goravel/framework v1.13.1-0.20231109083801-f2c86a7c0796/go.mod h1:5jKFbJzfqhaQTP3HCgbyrpnrCyoJjxN5JWSXO96H0iQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
diff --git a/routes/api.go b/routes/api.go
index 7e0a11dce1..dbba61fb7a 100644
--- a/routes/api.go
+++ b/routes/api.go
@@ -147,4 +147,6 @@ func Api() {
 	facades.Route().Get(entrance+"/assets/{any}", assetController.Index)
 	facades.Route().Get(entrance+"/loading/{any}", assetController.Index)
 	facades.Route().Get(entrance+"/{any}", assetController.Index)
+	facades.Route().Get(entrance+"/", assetController.Index)
+	facades.Route().Fallback(assetController.NotFound)
 }