diff --git a/assets/javascripts/discourse/routes/custom-wizard-step.js.es6 b/assets/javascripts/discourse/routes/custom-wizard-step.js.es6
index d2e141eb..969df1eb 100644
--- a/assets/javascripts/discourse/routes/custom-wizard-step.js.es6
+++ b/assets/javascripts/discourse/routes/custom-wizard-step.js.es6
@@ -4,7 +4,12 @@ import Route from "@ember/routing/route";
 
 export default Route.extend({
   beforeModel() {
-    this.set("wizard", getCachedWizard());
+    const wizard = getCachedWizard();
+    this.set("wizard", wizard);
+
+    if (!wizard || !wizard.user || !wizard.permitted || wizard.completed) {
+      this.replaceWith("customWizard");
+    }
   },
 
   model(params) {
diff --git a/test/javascripts/acceptance/step-test.js b/test/javascripts/acceptance/step-test.js
index 1d8427f4..cfa0f37a 100644
--- a/test/javascripts/acceptance/step-test.js
+++ b/test/javascripts/acceptance/step-test.js
@@ -21,6 +21,7 @@ acceptance("Step | Not permitted", function (needs) {
 });
 
 acceptance("Step | Step", function (needs) {
+  needs.user();
   needs.pretender((server, helper) => {
     server.get("/w/wizard.json", () => helper.response(wizard));
     server.put("/w/wizard/steps/:step_id", () => helper.response(update));
diff --git a/test/javascripts/acceptance/wizard-test.js b/test/javascripts/acceptance/wizard-test.js
index 51aa2968..d91edae5 100644
--- a/test/javascripts/acceptance/wizard-test.js
+++ b/test/javascripts/acceptance/wizard-test.js
@@ -18,10 +18,15 @@ acceptance("Wizard | Not logged in", function (needs) {
     server.get("/w/wizard.json", () => helper.response(wizardNoUser));
   });
 
-  test("Wizard no access requires login", async function (assert) {
+  test("Requires login", async function (assert) {
     await visit("/w/wizard");
     assert.ok(exists(".wizard-no-access.requires-login"));
   });
+
+  test("Requires login if a step path is used", async function (assert) {
+    await visit("/w/wizard/steps/1");
+    assert.ok(exists(".wizard-no-access.requires-login"));
+  });
 });
 
 acceptance("Wizard | Not permitted", function (needs) {
diff --git a/test/javascripts/helpers/wizard.js b/test/javascripts/helpers/wizard.js
index a895dcd7..700cedc7 100644
--- a/test/javascripts/helpers/wizard.js
+++ b/test/javascripts/helpers/wizard.js
@@ -34,7 +34,7 @@ allFieldsWizard.categories = cloneJSON(categoriesJson["categories"]);
 allFieldsWizard.groups = cloneJSON(groupsJson["groups"]);
 
 const update = cloneJSON(updateJson);
-update.wizard = cloneJSON(wizardJson);
+update.wizard = cloneJSON(wizard);
 
 export {
   wizardNoUser,