diff --git a/http/auth.go b/http/auth.go
index e84e94a2..d4987498 100644
--- a/http/auth.go
+++ b/http/auth.go
@@ -29,6 +29,9 @@ type signupBody struct {
 }
 
 func (e *Env) signupHandler(w http.ResponseWriter, r *http.Request) {
+	e.mux.RLock()
+	defer e.mux.RUnlock()
+
 	if !e.Settings.Signup {
 		httpErr(w, r, http.StatusForbidden, nil)
 		return
diff --git a/http/http.go b/http/http.go
index 7fc013a0..de9496f7 100644
--- a/http/http.go
+++ b/http/http.go
@@ -29,7 +29,7 @@ type Env struct {
 	Auther   types.Auther
 	Settings *types.Settings
 	Store    *types.Store
-	mux      sync.Mutex // settings mutex for Auther, Runner and Settings changes.
+	mux      sync.RWMutex // settings mutex for Settings changes.
 }
 
 // Handler ...
diff --git a/http/settings.go b/http/settings.go
index f0ab4c51..96441de5 100644
--- a/http/settings.go
+++ b/http/settings.go
@@ -23,6 +23,9 @@ func (e *Env) settingsGetHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	e.mux.RLock()
+	defer e.mux.RUnlock()
+
 	data := &settingsData{
 		Signup:   e.Settings.Signup,
 		Defaults: e.Settings.Defaults,
diff --git a/http/static.go b/http/static.go
index 2e98ec7c..3fcadb0a 100644
--- a/http/static.go
+++ b/http/static.go
@@ -15,6 +15,9 @@ import (
 )
 
 func (e *Env) getStaticData() map[string]interface{} {
+	e.mux.RLock()
+	defer e.mux.RUnlock()
+
 	staticURL := strings.TrimPrefix(e.Settings.BaseURL+"/static", "/")
 
 	data := map[string]interface{}{
@@ -85,6 +88,9 @@ func (e *Env) getStaticHandlers() (http.Handler, http.Handler) {
 	})
 
 	static := http.StripPrefix("/static/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		e.mux.RLock()
+		defer e.mux.RUnlock()
+
 		if e.Settings.Branding.Files != "" {
 			if strings.HasPrefix(r.URL.Path, "img/") {
 				path := filepath.Join(e.Settings.Branding.Files, r.URL.Path)
diff --git a/http/websockets.go b/http/websockets.go
index b765b9bd..46bbe3fc 100644
--- a/http/websockets.go
+++ b/http/websockets.go
@@ -61,7 +61,10 @@ func (e *Env) commandsHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	e.mux.RLock()
 	command, err := e.Settings.ParseCommand(raw)
+	e.mux.RUnlock()
+
 	if err != nil {
 		err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error()))
 		if err != nil {