diff --git a/assets/index.html b/assets/index.html
index 0735c41..afff079 100644
--- a/assets/index.html
+++ b/assets/index.html
@@ -261,19 +261,22 @@
       </div>
     </div>
   </div>
-  <script src="/-/assets/js/jquery-3.1.0.min.js"></script>
-  <script src="/-/assets/js/jquery.qrcode.js"></script>
-  <script src="/-/assets/js/jquery.scrollUp.min.js"></script>
-  <script src="/-/assets/js/qrcode.js"></script>
-  <script src="/-/assets/js/vue-1.0.min.js"></script>
-  <script src="/-/assets/js/showdown-1.6.4.min.js"></script>
-  <script src="/-/assets/js/moment.min.js"></script>
-  <script src="/-/assets/js/dropzone.js"></script>
-  <script src="/-/assets/js/underscore-min.js"></script>
-  <script src="/-/assets/js/clipboard-1.5.12.min.js"></script>
-  <script src="/-/assets/bootstrap-3.3.5/js/bootstrap.min.js"></script>
-  <script src='/-/assets/[["js/index.js" | urlhash ]]'></script>
-  <!-- <script src="/-/assets/js/index.js"></script> -->
+  <script>
+    // window.URL_PFEFIX = "[[.Prefix]]"
+  </script>
+  <script src="[[.Prefix]]/-/assets/js/jquery-3.1.0.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/jquery.qrcode.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/jquery.scrollUp.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/qrcode.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/vue-1.0.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/showdown-1.6.4.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/moment.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/dropzone.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/underscore-min.js"></script>
+  <script src="[[.Prefix]]/-/assets/js/clipboard-1.5.12.min.js"></script>
+  <script src="[[.Prefix]]/-/assets/bootstrap-3.3.5/js/bootstrap.min.js"></script>
+  <script src='[[.Prefix]]/-/assets/[["js/index.js" | urlhash ]]'></script>
+  <!-- <script src="[[.Prefix]]/-/assets/js/index.js"></script> -->
   <!--Sync status bar color with border-color on mobile platforms.-->
   <script>
     var META = document.getElementsByTagName("meta");
diff --git a/httpstaticserver.go b/httpstaticserver.go
index cd420f7..3de1d4e 100644
--- a/httpstaticserver.go
+++ b/httpstaticserver.go
@@ -43,6 +43,7 @@ type IndexFileItem struct {
 
 type HTTPStaticServer struct {
 	Root            string
+	Prefix          string
 	Upload          bool
 	Delete          bool
 	Title           string
@@ -56,10 +57,11 @@ type HTTPStaticServer struct {
 }
 
 func NewHTTPStaticServer(root string) *HTTPStaticServer {
-	if root == "" {
-		root = "./"
-	}
-	root = filepath.ToSlash(root)
+	// if root == "" {
+	// 	root = "./"
+	// }
+	// root = filepath.ToSlash(root)
+	root = filepath.ToSlash(filepath.Clean(root))
 	if !strings.HasSuffix(root, "/") {
 		root = root + "/"
 	}
@@ -97,9 +99,23 @@ func (s *HTTPStaticServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	s.m.ServeHTTP(w, r)
 }
 
+// Return real path with Seperator(/)
+func (s *HTTPStaticServer) getRealPath(r *http.Request) string {
+	path := mux.Vars(r)["path"]
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	path = cleanPath(path) // use cleanPath to prevent safe issues
+	relPath, err := filepath.Rel(s.Prefix, path)
+	if err != nil {
+		relPath = filepath.Join(s.Prefix, path)
+	}
+	return filepath.ToSlash(relPath)
+}
+
 func (s *HTTPStaticServer) hIndex(w http.ResponseWriter, r *http.Request) {
 	path := mux.Vars(r)["path"]
-	relPath := filepath.Join(s.Root, path)
+	realPath := s.getRealPath(r)
 	if r.FormValue("json") == "true" {
 		s.hJSONList(w, r)
 		return
@@ -115,15 +131,15 @@ func (s *HTTPStaticServer) hIndex(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	log.Println("GET", path, relPath)
-	if r.FormValue("raw") == "false" || isDir(relPath) {
+	log.Println("GET", path, realPath)
+	if r.FormValue("raw") == "false" || isDir(realPath) {
 		if r.Method == "HEAD" {
 			return
 		}
 		renderHTML(w, "index.html", s)
 	} else {
 		if filepath.Base(path) == YAMLCONF {
-			auth := s.readAccessConf(path)
+			auth := s.readAccessConf(realPath)
 			if !auth.Delete {
 				http.Error(w, "Security warning, not allowed to read", http.StatusForbidden)
 				return
@@ -132,42 +148,44 @@ func (s *HTTPStaticServer) hIndex(w http.ResponseWriter, r *http.Request) {
 		if r.FormValue("download") == "true" {
 			w.Header().Set("Content-Disposition", "attachment; filename="+strconv.Quote(filepath.Base(path)))
 		}
-		http.ServeFile(w, r, relPath)
+		http.ServeFile(w, r, realPath)
 	}
 }
 
-func (s *HTTPStaticServer) hMkdir(w http.ResponseWriter, req *http.Request) {
-	path := filepath.Dir(mux.Vars(req)["path"])
-	auth := s.readAccessConf(path)
-	if !auth.canDelete(req) {
-		http.Error(w, "Mkdir forbidden", http.StatusForbidden)
-		return
-	}
+// func (s *HTTPStaticServer) hMkdir(w http.ResponseWriter, req *http.Request) {
+// 	path := filepath.Dir(mux.Vars(req)["path"])
+// 	realPath := s.getRealPath(req)
+// 	auth := s.readAccessConf(realPath)
+// 	if !auth.canDelete(req) {
+// 		http.Error(w, "Mkdir forbidden", http.StatusForbidden)
+// 		return
+// 	}
 
-	name := filepath.Base(mux.Vars(req)["path"])
-	if err := checkFilename(name); err != nil {
-		http.Error(w, err.Error(), http.StatusForbidden)
-		return
-	}
-	err := os.Mkdir(filepath.Join(s.Root, path, name), 0755)
-	if err != nil {
-		http.Error(w, err.Error(), 500)
-		return
-	}
-	w.Write([]byte("Success"))
-}
+// 	name := filepath.Base(mux.Vars(req)["path"])
+// 	if err := checkFilename(name); err != nil {
+// 		http.Error(w, err.Error(), http.StatusForbidden)
+// 		return
+// 	}
+// 	err := os.Mkdir(filepath.Join(s.Root, path, name), 0755)
+// 	if err != nil {
+// 		http.Error(w, err.Error(), 500)
+// 		return
+// 	}
+// 	w.Write([]byte("Success"))
+// }
 
 func (s *HTTPStaticServer) hDelete(w http.ResponseWriter, req *http.Request) {
 	path := mux.Vars(req)["path"]
-	path = filepath.Clean(path) // for safe reason, prevent path contain ..
-	auth := s.readAccessConf(path)
+	realPath := s.getRealPath(req)
+	// path = filepath.Clean(path) // for safe reason, prevent path contain ..
+	auth := s.readAccessConf(realPath)
 	if !auth.canDelete(req) {
 		http.Error(w, "Delete forbidden", http.StatusForbidden)
 		return
 	}
 
 	// TODO: path safe check
-	err := os.RemoveAll(filepath.Join(s.Root, path))
+	err := os.RemoveAll(realPath)
 	if err != nil {
 		pathErr, ok := err.(*os.PathError)
 		if ok {
@@ -181,11 +199,10 @@ func (s *HTTPStaticServer) hDelete(w http.ResponseWriter, req *http.Request) {
 }
 
 func (s *HTTPStaticServer) hUploadOrMkdir(w http.ResponseWriter, req *http.Request) {
-	path := mux.Vars(req)["path"]
-	dirpath := filepath.Join(s.Root, path)
+	dirpath := s.getRealPath(req)
 
 	// check auth
-	auth := s.readAccessConf(path)
+	auth := s.readAccessConf(dirpath)
 	if !auth.canUpload(req) {
 		http.Error(w, "Upload forbidden", http.StatusForbidden)
 		return
@@ -309,7 +326,7 @@ func parseApkInfo(path string) (ai *ApkInfo) {
 
 func (s *HTTPStaticServer) hInfo(w http.ResponseWriter, r *http.Request) {
 	path := mux.Vars(r)["path"]
-	relPath := filepath.Join(s.Root, path)
+	relPath := s.getRealPath(r)
 
 	fi, err := os.Stat(relPath)
 	if err != nil {
@@ -340,8 +357,7 @@ func (s *HTTPStaticServer) hInfo(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *HTTPStaticServer) hZip(w http.ResponseWriter, r *http.Request) {
-	path := mux.Vars(r)["path"]
-	CompressToZip(w, filepath.Join(s.Root, path))
+	CompressToZip(w, s.getRealPath(r))
 }
 
 func (s *HTTPStaticServer) hUnzip(w http.ResponseWriter, r *http.Request) {
@@ -373,7 +389,7 @@ func (s *HTTPStaticServer) hPlist(w http.ResponseWriter, r *http.Request) {
 		path = path[0:len(path)-6] + ".ipa"
 	}
 
-	relPath := filepath.Join(s.Root, path)
+	relPath := s.getRealPath(r)
 	plinfo, err := parseIPA(relPath)
 	if err != nil {
 		http.Error(w, err.Error(), 500)
@@ -453,8 +469,7 @@ func (s *HTTPStaticServer) genPlistLink(httpPlistLink string) (plistUrl string,
 }
 
 func (s *HTTPStaticServer) hFileOrDirectory(w http.ResponseWriter, r *http.Request) {
-	path := mux.Vars(r)["path"]
-	http.ServeFile(w, r, filepath.Join(s.Root, path))
+	http.ServeFile(w, r, s.getRealPath(r))
 }
 
 type HTTPFileInfo struct {
@@ -557,9 +572,9 @@ func (c *AccessConf) canUpload(r *http.Request) bool {
 
 func (s *HTTPStaticServer) hJSONList(w http.ResponseWriter, r *http.Request) {
 	requestPath := mux.Vars(r)["path"]
-	localPath := filepath.Join(s.Root, requestPath)
+	realPath := s.getRealPath(r)
 	search := r.FormValue("search")
-	auth := s.readAccessConf(requestPath)
+	auth := s.readAccessConf(realPath)
 	auth.Upload = auth.canUpload(r)
 	auth.Delete = auth.canDelete(r)
 
@@ -577,7 +592,7 @@ func (s *HTTPStaticServer) hJSONList(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	} else {
-		infos, err := ioutil.ReadDir(localPath)
+		infos, err := ioutil.ReadDir(realPath)
 		if err != nil {
 			http.Error(w, err.Error(), 500)
 			return
@@ -606,7 +621,7 @@ func (s *HTTPStaticServer) hJSONList(w http.ResponseWriter, r *http.Request) {
 			lr.Name = filepath.ToSlash(name) // fix for windows
 		}
 		if info.IsDir() {
-			name := deepPath(localPath, info.Name())
+			name := deepPath(realPath, info.Name())
 			lr.Name = name
 			lr.Path = filepath.Join(filepath.Dir(path), name)
 			lr.Type = "dir"
@@ -697,19 +712,19 @@ func (s *HTTPStaticServer) defaultAccessConf() AccessConf {
 	}
 }
 
-func (s *HTTPStaticServer) readAccessConf(requestPath string) (ac AccessConf) {
-	requestPath = filepath.Clean(requestPath)
-	if requestPath == "/" || requestPath == "" || requestPath == "." {
+func (s *HTTPStaticServer) readAccessConf(realPath string) (ac AccessConf) {
+	relativePath, err := filepath.Rel(s.Root, realPath)
+	if err != nil || relativePath == "." || relativePath == "" { // actually relativePath is always "." if root == realPath
 		ac = s.defaultAccessConf()
+		realPath = s.Root
 	} else {
-		parentPath := filepath.Dir(requestPath)
+		parentPath := filepath.Dir(realPath)
 		ac = s.readAccessConf(parentPath)
 	}
-	relPath := filepath.Join(s.Root, requestPath)
-	if isFile(relPath) {
-		relPath = filepath.Dir(relPath)
+	if isFile(realPath) {
+		realPath = filepath.Dir(realPath)
 	}
-	cfgFile := filepath.Join(relPath, YAMLCONF)
+	cfgFile := filepath.Join(realPath, YAMLCONF)
 	data, err := ioutil.ReadFile(cfgFile)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -742,16 +757,6 @@ func deepPath(basedir, name string) string {
 	return name
 }
 
-func isFile(path string) bool {
-	info, err := os.Stat(path)
-	return err == nil && info.Mode().IsRegular()
-}
-
-func isDir(path string) bool {
-	info, err := os.Stat(path)
-	return err == nil && info.Mode().IsDir()
-}
-
 func assetsContent(name string) string {
 	fd, err := Assets.Open(name)
 	if err != nil {
diff --git a/main.go b/main.go
index 279dfa5..7fe3a92 100644
--- a/main.go
+++ b/main.go
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"regexp"
 	"runtime"
 	"strconv"
 	"strings"
@@ -20,6 +21,7 @@ import (
 	"github.com/go-yaml/yaml"
 	"github.com/goji/httpauth"
 	"github.com/gorilla/handlers"
+	"github.com/gorilla/mux"
 	_ "github.com/shurcooL/vfsgen"
 )
 
@@ -28,6 +30,7 @@ type Configure struct {
 	Addr            string   `yaml:"addr"`
 	Port            int      `yaml:"port"`
 	Root            string   `yaml:"root"`
+	Prefix          string   `yaml:"prefix"`
 	HTTPAuth        string   `yaml:"httpauth"`
 	Cert            string   `yaml:"cert"`
 	Key             string   `yaml:"key"`
@@ -102,6 +105,7 @@ func parseFlags() error {
 	kingpin.Version(versionMessage())
 	kingpin.Flag("conf", "config file path, yaml format").FileVar(&gcfg.Conf)
 	kingpin.Flag("root", "root directory, default ./").Short('r').StringVar(&gcfg.Root)
+	kingpin.Flag("prefix", "url prefix, eg /foo").StringVar(&gcfg.Prefix)
 	kingpin.Flag("port", "listen port, default 8000").IntVar(&gcfg.Port)
 	kingpin.Flag("addr", "listen address, eg 127.0.0.1:8000").Short('a').StringVar(&gcfg.Addr)
 	kingpin.Flag("cert", "tls cert.pem path").StringVar(&gcfg.Cert)
@@ -134,6 +138,17 @@ func parseFlags() error {
 	return nil
 }
 
+func fixPrefix(prefix string) string {
+	prefix = regexp.MustCompile(`/*$`).ReplaceAllString(prefix, "")
+	if !strings.HasPrefix(prefix, "/") {
+		prefix = "/" + prefix
+	}
+	if prefix == "/" {
+		prefix = ""
+	}
+	return prefix
+}
+
 func main() {
 	if err := parseFlags(); err != nil {
 		log.Fatal(err)
@@ -144,7 +159,14 @@ func main() {
 	}
 	log.SetFlags(log.Lshortfile | log.LstdFlags)
 
+	// make sure prefix matches: ^/.*[^/]$
+	gcfg.Prefix = fixPrefix(gcfg.Prefix)
+	if gcfg.Prefix != "" {
+		log.Printf("url prefix: %s", gcfg.Prefix)
+	}
+
 	ss := NewHTTPStaticServer(gcfg.Root)
+	ss.Prefix = gcfg.Prefix
 	ss.Theme = gcfg.Theme
 	ss.Title = gcfg.Title
 	ss.GoogleTrackerID = gcfg.GoogleTrackerID
@@ -163,7 +185,7 @@ func main() {
 	if ss.PlistProxy != "" {
 		log.Printf("plistproxy: %s", strconv.Quote(ss.PlistProxy))
 	}
-	
+
 	var hdlr http.Handler = ss
 
 	hdlr = accesslog.NewLoggingHandler(hdlr, logger)
@@ -192,15 +214,22 @@ func main() {
 		hdlr = handlers.ProxyHeaders(hdlr)
 	}
 
-	http.Handle("/", hdlr)
-	http.Handle("/-/assets/", http.StripPrefix("/-/assets/", http.FileServer(Assets)))
-	http.HandleFunc("/-/sysinfo", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
+	mainRooter := mux.NewRouter()
+	rooter := mainRooter
+	if gcfg.Prefix != "" {
+		rooter = mainRooter.PathPrefix(gcfg.Prefix).Subrouter()
+	}
+
+	rooter.PathPrefix("/-/assets/").Handler(http.StripPrefix(gcfg.Prefix+"/-/assets/", http.FileServer(Assets)))
+	rooter.HandleFunc("/-/sysinfo", func(w http.ResponseWriter, r *http.Request) {
 		data, _ := json.Marshal(map[string]interface{}{
 			"version": VERSION,
 		})
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(data)))
 		w.Write(data)
 	})
+	rooter.PathPrefix("/").Handler(hdlr)
 
 	if gcfg.Addr == "" {
 		gcfg.Addr = fmt.Sprintf(":%d", gcfg.Port)
@@ -211,11 +240,16 @@ func main() {
 	_, port, _ := net.SplitHostPort(gcfg.Addr)
 	log.Printf("listening on %s, local address http://%s:%s\n", strconv.Quote(gcfg.Addr), getLocalIP(), port)
 
+	srv := &http.Server{
+		Handler: mainRooter,
+		Addr:    gcfg.Addr,
+	}
+
 	var err error
 	if gcfg.Key != "" && gcfg.Cert != "" {
-		err = http.ListenAndServeTLS(gcfg.Addr, gcfg.Cert, gcfg.Key, nil)
+		err = srv.ListenAndServeTLS(gcfg.Cert, gcfg.Key)
 	} else {
-		err = http.ListenAndServe(gcfg.Addr, nil)
+		err = srv.ListenAndServe()
 	}
 	log.Fatal(err)
 }
diff --git a/utils.go b/utils.go
index 99bdea4..d627b16 100644
--- a/utils.go
+++ b/utils.go
@@ -4,6 +4,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 )
 
@@ -80,3 +81,18 @@ func fileExists(path string) bool {
 	}
 	return !info.IsDir()
 }
+
+// Convert path to normal paths
+func cleanPath(path string) string {
+	return filepath.ToSlash(filepath.Clean(path))
+}
+
+func isFile(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && info.Mode().IsRegular()
+}
+
+func isDir(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && info.Mode().IsDir()
+}
diff --git a/utils_test.go b/utils_test.go
index 2ba328a..c04ccf3 100644
--- a/utils_test.go
+++ b/utils_test.go
@@ -25,3 +25,25 @@ func TestSublimeContains(t *testing.T) {
 		}
 	}
 }
+
+func TestCleanPath(t *testing.T) {
+	tests := []struct {
+		orig   string
+		expect string
+	}{
+		// {"C:\\hello", "C:/hello"}, // Only works in windows
+		{"", "."},
+		{"//../foo", "/foo"},
+		{"/../../", "/"},
+		{"/hello/world/..", "/hello"},
+		{"/..", "/"},
+		{"/foo/..", "/"},
+		{"/-/foo", "/-/foo"},
+	}
+	for _, v := range tests {
+		res := cleanPath(v.orig)
+		if res != v.expect {
+			t.Fatalf("Clean path(%v) expect(%v) but got(%v)", v.orig, v.expect, res)
+		}
+	}
+}