diff --git a/lib/archive-account.js b/lib/archive-account.js
index 44928f6be..222b2421f 100644
--- a/lib/archive-account.js
+++ b/lib/archive-account.js
@@ -14,6 +14,7 @@ const Meta = require("./metadata");
 const Logger = require("./log");
 const plugins = require("./plugin-manager");
 const HK = require('./hk-util');
+const MFA = require("./storage/mfa");
 
 let SSOUtils = plugins.SSO && plugins.SSO.utils;
 
@@ -212,6 +213,7 @@ COMMANDS.start = (edPublic, blockId, reason) => {
                 }
                 Log.info('MODERATION_ACCOUNT_BLOCK', safeKey, waitFor());
             }));
+            MFA.delete(Env, blockId, waitFor());
             if (!SSOUtils) { return; }
             SSOUtils.deleteAccount(Env, blockId, waitFor((err) => {
                 if (err) {
diff --git a/lib/http-worker.js b/lib/http-worker.js
index fb9bc2f24..b1768016f 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -444,6 +444,25 @@ app.use('/block/', function (req, res, next) {
             w.abort();
             next();
         }
+    }).nThen(function (w) {
+        // Block is protected with 2FA or SSO, make sure it still exists
+        const url = req.url;
+        if (typeof(url) !== "string") { return; }
+        const s = url.split('/');
+        const id = s[2];
+        if (!(s[1]?.length === 2 && BlockStore.isValidKey(id))) { return; }
+        BlockStore.isAvailable(Env, id, w((err, val) => {
+            if (err) { return; }
+            if (val !== false) { return; }
+            // Block doesn't exist, send the placeholder
+            w.abort();
+            return BlockStore.readPlaceholder(Env, id, reason => {
+                res.status(404).json({
+                    reason,
+                    code: 404
+                });
+            });
+        }));
     }).nThen(function (w) {
         // We should only be able to reach this logic
         // if we successfully loaded and parsed some JSON
diff --git a/www/admin/inner.js b/www/admin/inner.js
index 86a9e4bc6..00765e344 100644
--- a/www/admin/inner.js
+++ b/www/admin/inner.js
@@ -1415,6 +1415,7 @@ define([
         });
 
         var getBlockId = (val) => {
+            if (val.length === 44) { return val; }
             var url;
             try {
                 url = new URL(val, ApiConfig.httpUnsafeOrigin);