diff --git a/.ht.router.php b/.ht.router.php
index 054f7119b0eadf8955b3048a2c5aaad14257829a..2c8a6f6ac35821ab3c09c17bfdbf31f3c7613b9e 100644
--- a/.ht.router.php
+++ b/.ht.router.php
@@ -24,6 +24,12 @@
  * @see http://php.net/manual/en/features.commandline.webserver.php
  */
 
+if (PHP_SAPI !== 'cli-server') {
+  // Bail out if this is not PHP's Development Server.
+  header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+  exit;
+}
+
 $url = parse_url($_SERVER['REQUEST_URI']);
 if (file_exists(__DIR__ . $url['path'])) {
   // Serve the requested resource as-is.
diff --git a/core/assets/scaffold/files/ht.router.php b/core/assets/scaffold/files/ht.router.php
index 054f7119b0eadf8955b3048a2c5aaad14257829a..2c8a6f6ac35821ab3c09c17bfdbf31f3c7613b9e 100644
--- a/core/assets/scaffold/files/ht.router.php
+++ b/core/assets/scaffold/files/ht.router.php
@@ -24,6 +24,12 @@
  * @see http://php.net/manual/en/features.commandline.webserver.php
  */
 
+if (PHP_SAPI !== 'cli-server') {
+  // Bail out if this is not PHP's Development Server.
+  header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+  exit;
+}
+
 $url = parse_url($_SERVER['REQUEST_URI']);
 if (file_exists(__DIR__ . $url['path'])) {
   // Serve the requested resource as-is.