diff --git a/TODO.md b/TODO.md
index 49b121f4..3f96c54c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -171,6 +171,7 @@ These are roughly in order of completition
 - [x] Ulid instead of Uuid for user keys
   - <https://discord.com/channels/873880840487206962/900758376164757555/1012942974608474142>
   - since users are actively using our service, we will need to support both
+- [x] get to /, when not serving a websocket, should have a simple welcome page. maybe with a button to update your wallet. 
 - [ ] active requests per second per api key
 - [ ] distribution of methods per api key (eth_call, eth_getLogs, etc.)
 - [-] let users choose a % to log (or maybe x/second). someone like curve logging all reverts will be a BIG database very quickly
@@ -357,7 +358,6 @@ in another repo: event subscriber
   #[cfg(feature = "with-uuid")]
   pub use uuid::Builder as UuidBuilder;
   ```
-- [ ] get to /, when not serving a websocket, should have a simple welcome page. maybe with a button to update your wallet. 
 - [ ] rate limit thoughts:
   - if someone subscribes to all pending transactions, how should that count against rate limits
   - when those rate limits are hit, what should happen?
@@ -373,7 +373,6 @@ in another repo: event subscriber
 - [ ] web3connection3.block(...) might wait forever. be sure to do it safely
 - [ ] search for all "todo!"
 - [ ] when using a bunch of slow public servers, i see "no servers in sync" even when things should be right
-  - [ ] i think checking the parents of the heaviest chain works most of the time, but not always
   - maybe iterate connection heads by total weight? i still think we need to include parent hashes
 - [ ] i see "No block found" sometimes for a single server's block. Not sure why since reads should happen after writes
 - [ ] whats going on here? why is it rolling back? maybe total_difficulty was a LOT higher?
@@ -386,7 +385,6 @@ in another repo: event subscriber
 - [ ] web3_proxy_cli command should read database settings from config
 - [ ] how should we handle reverting transactions? they won't confirm for a while after we send them
 - [ ] allow configuration of the expiration time of bearer tokens. currently defaults to 4 weeks
-- [ ] instead of putting everything under /rpc, have a site_prefix config?
 - [ ] Ulid instead of Uuid for database ids
   - might have to use Uuid in sea-orm and then convert to Ulid on display
 - [ ] emit stat when an IP/key goes over rate limits
diff --git a/web3_proxy/src/frontend/mod.rs b/web3_proxy/src/frontend/mod.rs
index 827c8a2e..b4748bee 100644
--- a/web3_proxy/src/frontend/mod.rs
+++ b/web3_proxy/src/frontend/mod.rs
@@ -47,7 +47,6 @@ pub async fn serve(port: u16, proxy_app: Arc<Web3ProxyApp>) -> anyhow::Result<()
         });
 
     // build our axum Router
-    // TODO: these should probbably all start with /rpc. then / can be the static site
     let app = Router::new()
         // routes should be order most to least common
         .route("/rpc", post(rpc_proxy_http::proxy_web3_rpc))
@@ -60,18 +59,18 @@ pub async fn serve(port: u16, proxy_app: Arc<Web3ProxyApp>) -> anyhow::Result<()
             "/rpc/:user_key",
             get(rpc_proxy_ws::websocket_handler_with_key),
         )
-        .route("/rpc/health", get(status::health))
-        .route("/rpc/status", get(status::status))
+        .route("/health", get(status::health))
+        .route("/status", get(status::status))
         // TODO: make this optional or remove it since it is available on another port
-        .route("/rpc/prometheus", get(status::prometheus))
-        .route("/rpc/user/login/:user_address", get(users::get_login))
+        .route("/prometheus", get(status::prometheus))
+        .route("/user/login/:user_address", get(users::get_login))
         .route(
-            "/rpc/user/login/:user_address/:message_eip",
+            "/user/login/:user_address/:message_eip",
             get(users::get_login),
         )
-        .route("/rpc/user/login", post(users::post_login))
-        .route("/rpc/user", post(users::post_user))
-        .route("/rpc/user/logout", get(users::get_logout))
+        .route("/user/login", post(users::post_login))
+        .route("/user", post(users::post_user))
+        .route("/user/logout", get(users::get_logout))
         // layers are ordered bottom up
         // the last layer is first for requests and last for responses
         // Mark the `Authorization` request header as sensitive so it doesn't show in logs