diff --git a/test/api/user/PUT-user.test.js b/test/api/user/PUT-user.test.js
index b697e2f5b2..d56466846c 100644
--- a/test/api/user/PUT-user.test.js
+++ b/test/api/user/PUT-user.test.js
@@ -3,7 +3,9 @@ import {
   requester,
 } from '../../helpers/api.helper';
 
-describe('PUT /user', () => {
+import { each } from 'lodash';
+
+describe.only('PUT /user', () => {
   let api, user;
 
   beforeEach(() => {
@@ -13,11 +15,40 @@ describe('PUT /user', () => {
     });
   });
 
-  it('updates the user', () => {
-    return api.put('/user', {
-      'profile.name' : 'Frodo',
-    }).then((updatedUser) => {
-      expect(updatedUser.profile.name).to.eql('Frodo');
+  context('allowed paths', () => {
+    it('updates the user', () => {
+      return api.put('/user', {
+        'profile.name' : 'Frodo',
+        'preferences.costume': true,
+      }).then((updatedUser) => {
+        expect(updatedUser.profile.name).to.eql('Frodo');
+        expect(updatedUser.preferences.costume).to.eql(true);
+      });
+    });
+  });
+
+  context('protected paths', () => {
+    let protectedPaths = {
+      'gem balance': {balance: 100},
+      'auth': {'auth.blocked': true, 'auth.timestamps.created': new Date()},
+      'contributor': {'contributor.level': 9, 'contributor.admin': true, 'contributor.text': 'some text'},
+      'backer': {'backer.tier': 10, 'backer.npc': 'Bilbo'},
+      'subscriptions': {'purchased.plan.extraMonths': 500, 'purchased.plan.consecutive.trinkets': 1000},
+      'customization gem purchases': {'purchased.background.tavern': true, 'purchased.skin.bear': true},
+      'tasks': {todos: [], habits: [], dailys: [], rewards: []},
+    };
+
+    each(protectedPaths, (data, testName) => {
+      it(`does not allow updating ${testName}`, () => {
+        let errorText = [];
+        each(data, (value, path) => {
+          errorText.push(`path \`${path}\` was not saved, as it's a protected path. See https://github.com/HabitRPG/habitrpg/blob/develop/API.md for PUT /api/v2/user.`);
+        });
+        return expect(api.put('/user', data)).to.eventually.be.rejected.and.eql({
+          code: 401,
+          text: errorText,
+        });
+      });
     });
   });
 });