# Bypass Imunify360 / ModSecurity for API requests
# This allows the desktop client to reach the PHP files directly

SecFilterEngine Off
SecRuleEngine Off

# Allow all origins for API
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, X-Api-Secret"

# Disable mod_security rules that block non-browser requests
<IfModule mod_security.c>
    SecFilterEngine Off
    SecFilterScanPOST Off
</IfModule>

# Remove Imunify360 challenge for this directory
<IfModule Litespeed>
    RewriteEngine off
</IfModule>