diff --git a/packages/website/scripts/preview.js b/packages/website/scripts/preview.js
index 6d6ab1ba1..5936be344 100644
--- a/packages/website/scripts/preview.js
+++ b/packages/website/scripts/preview.js
@@ -20,6 +20,9 @@ const serverHandle = (req, res) => {
   }
   const url = req.url === '/' ? config.indexFile : req.url
 
+    if (url.includes('..')) {
+        res.writeHead(403); res.end('request is blocked'); return;
+    }
   const urlInfo = path.parse(url)
 
   const filePath = path.join(__dirname, config.baseContent, url)