diff --git a/internal/fusefrontend_reverse/isexcluded_test.go b/internal/fusefrontend_reverse/isexcluded_test.go
new file mode 100644
index 0000000..fc3831a
--- /dev/null
+++ b/internal/fusefrontend_reverse/isexcluded_test.go
@@ -0,0 +1,26 @@
+package fusefrontend_reverse
+
+import (
+	"testing"
+)
+
+func verifyExcluded(t *testing.T, rfs *ReverseFS, paths []string) {
+	for _, p := range paths {
+		if !rfs.isExcluded(p) {
+			t.Errorf("Path %q should be excluded, but is not", p)
+		}
+	}
+	if t.Failed() {
+		t.Logf("cExclude = %#v", rfs.cExclude)
+	}
+}
+
+// Note: See also the integration tests in
+// tests/reverse/exclude_test.go
+func TestIsExcluded(t *testing.T) {
+	var rfs ReverseFS
+	// If the root directory is excluded, all files and subdirs should be excluded
+	// as well
+	rfs.cExclude = []string{""}
+	verifyExcluded(t, &rfs, []string{"", "foo", "foo/bar"})
+}
diff --git a/internal/fusefrontend_reverse/rfs.go b/internal/fusefrontend_reverse/rfs.go
index ba8810c..1ca0b28 100644
--- a/internal/fusefrontend_reverse/rfs.go
+++ b/internal/fusefrontend_reverse/rfs.go
@@ -63,6 +63,10 @@ func NewFS(args fusefrontend.Args, c *contentenc.ContentEnc, n *nametransform.Na
 			if clean != dirty {
 				tlog.Warn.Printf("-exclude: non-canonical path %q has been interpreted as %q", dirty, clean)
 			}
+			if clean == "" {
+				tlog.Fatal.Printf("-exclude: excluding the root dir %q makes no sense", clean)
+				os.Exit(exitcodes.ExcludeError)
+			}
 			cPath, err := fs.EncryptPath(clean)
 			if err != nil {
 				tlog.Fatal.Printf("-exclude: EncryptPath %q failed: %v", clean, err)
@@ -90,6 +94,11 @@ func relDir(path string) string {
 // (used when -exclude is passed by the user)
 func (rfs *ReverseFS) isExcluded(relPath string) bool {
 	for _, e := range rfs.cExclude {
+		// If the root dir is excluded, everything is excluded.
+		if e == "" {
+			return true
+		}
+		// This exact path is excluded
 		if e == relPath {
 			return true
 		}