diff --git a/caddyhttp/proxy/upstream.go b/caddyhttp/proxy/upstream.go
index a89fdfb01..8dac144ef 100644
--- a/caddyhttp/proxy/upstream.go
+++ b/caddyhttp/proxy/upstream.go
@@ -665,7 +665,17 @@ func (u *staticUpstream) Select(r *http.Request) *UpstreamHost {
 
 func (u *staticUpstream) AllowedPath(requestPath string) bool {
 	for _, ignoredSubPath := range u.IgnoredSubPaths {
-		if httpserver.Path(path.Clean(requestPath)).Matches(path.Join(u.From(), ignoredSubPath)) {
+		p := path.Clean(requestPath)
+		e := path.Join(u.From(), ignoredSubPath)
+		// Re-add a trailing slashes if the original
+		// paths had one and the cleaned paths don't
+		if strings.HasSuffix(requestPath, "/") && !strings.HasSuffix(p, "/") {
+			p = p + "/"
+		}
+		if strings.HasSuffix(ignoredSubPath, "/") && !strings.HasSuffix(e, "/") {
+			e = e + "/"
+		}
+		if httpserver.Path(p).Matches(e) {
 			return false
 		}
 	}
diff --git a/caddyhttp/proxy/upstream_test.go b/caddyhttp/proxy/upstream_test.go
index 2c72f97a8..2e10eb092 100644
--- a/caddyhttp/proxy/upstream_test.go
+++ b/caddyhttp/proxy/upstream_test.go
@@ -136,7 +136,7 @@ func TestRegisterPolicy(t *testing.T) {
 func TestAllowedPaths(t *testing.T) {
 	upstream := &staticUpstream{
 		from:            "/proxy",
-		IgnoredSubPaths: []string{"/download", "/static"},
+		IgnoredSubPaths: []string{"/download", "/static", "/trailingslash/"},
 	}
 	tests := []struct {
 		url      string
@@ -153,6 +153,8 @@ func TestAllowedPaths(t *testing.T) {
 		{"/proxy//static", false},
 		{"/proxy//static//download", false},
 		{"/proxy//download", false},
+		{"/proxy/trailingslash", true},
+		{"/proxy/trailingslash/", false},
 	}
 
 	for i, test := range tests {