[orbis] Weekly backup 2026-07-07 — 318 files changed, 48597 insertions(+), 7 deletions(-)

sites/epictravelexpeditions.com/public_html/api/.htaccess

@@ -0,0 +1,60 @@
+# Epic Travel & Expeditions - LiteSpeed .htaccess for CyberPanel
+# Optimized for LiteSpeed Web Server
+
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteBase /api/
+
+    # Block direct access to config.php / .env - this was reachable at
+    # /api/config.php in production (200 OK) despite the FilesMatch/Require
+    # rule below, which LiteSpeed appears not to honor from .htaccess here.
+    # Matching on REQUEST_URI (not a direct RewriteRule pattern) is what's
+    # confirmed to actually work on this LiteSpeed setup.
+    RewriteCond %{REQUEST_URI} /(config\.php|\.env)$
+    RewriteRule .* - [F,L]
+
+    # Route all requests to index.php
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php/$1 [L,QSA]
+</IfModule>
+
+# LiteSpeed Cache Control
+<IfModule LiteSpeed>
+    # Disable caching for API
+    CacheLookup off
+</IfModule>
+
+# Security Headers
+<IfModule mod_headers.c>
+    Header set X-Content-Type-Options "nosniff"
+    Header set X-Frame-Options "SAMEORIGIN"
+    Header set X-XSS-Protection "1; mode=block"
+    Header set X-Powered-By "Epic Travel API"
+</IfModule>
+
+# Protect sensitive files
+<FilesMatch "^(config\.php|\.env)">
+    Require all denied
+</FilesMatch>
+
+# PHP Settings (LiteSpeed compatible)
+<IfModule mod_php7.c>
+    php_value upload_max_filesize 10M
+    php_value post_max_size 10M
+    php_value max_execution_time 300
+    php_value max_input_time 300
+    php_value memory_limit 256M
+</IfModule>
+
+# Compression
+<IfModule mod_deflate.c>
+    AddOutputFilterByType DEFLATE application/json
+    AddOutputFilterByType DEFLATE text/plain
+    AddOutputFilterByType DEFLATE text/html
+</IfModule>
+
+# Browser Caching
+<IfModule mod_expires.c>
+    ExpiresActive Off
+</IfModule>