[orbis] Weekly backup 2026-07-19 — 9 files changed, 37 insertions(+), 2 deletions(-)

ols-vhosts/parkerslingshotrentals.com/vhost.conf

@@ -89,3 +89,17 @@ vhssl  {
   enableStapling           1
   ocspRespMaxAge           86400
 }
+
+context / {
+  location                $DOC_ROOT/
+  allowBrowse             1
+  authName                Coming Soon
+  realm                   ComingSoonRealm
+  indexFiles              index.php, index.html
+}
+
+realm ComingSoonRealm {
+  userDB {
+    location                /home/parkerslingshotrentals.com/.htpasswd
+  }
+}

ols-vhosts/site-list.txt

@@ -1,9 +1,9 @@
-# Websites on DO server — 2026-07-12
+# Websites on DO server — 2026-07-19
 
 - epictravelexpeditions.com  (3.8M)
 - orbishosting.com  (113M)
 - orbis.orbishosting.com  (40K)
-- parkerslingshotrentals.com  (300K)
+- parkerslingshotrentals.com  (304K)
 - tomsjavajive.com  (3.9M)
 - tomtomgames.com  (868K)
 - worktracking.orbishosting.com  (124K)

sites/parkerslingshotrentals.com/public_html/.htaccess.bak-20260717

@@ -0,0 +1,21 @@
+<Files db.php>
+  Order deny,allow
+  Deny from all
+</Files>
+
+RewriteEngine On
+RewriteRule ^db\.php$ - [F,L]
+RewriteCond %{REQUEST_URI} ^/db\.php$
+RewriteRule .* - [F,L]
+
+# .git/ was found directly downloadable (leaked GitHub PAT) - same class of
+# issue found and fixed on sibling sites this session.
+RewriteCond %{REQUEST_URI} ^/\.git
+RewriteRule .* - [F,L]
+
+# uploads/ (customer license/insurance docs) must never be directly downloadable -
+# same Order/Deny-doesn't-work-on-OpenLiteSpeed gotcha as .git above. Docs are
+# served only through view-doc.php / admin/view-doc.php, which read by filesystem
+# path via readfile() - blocking direct URL access here doesn't break that flow.
+RewriteCond %{REQUEST_URI} ^/uploads/
+RewriteRule .* - [F,L]