Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE" DirectoryIndex index.php index.html RewriteEngine On # PROTECTED DIRECTORIES RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^/?(api|client)/ - [F] RewriteRule ^/?data/ - [F] RewriteRule ^/?application/ - [F] RewriteRule ^/?custom/ - [F] RewriteRule ^/?vendor/ - [F] RewriteRule ^/?client/?$ - [F] #END PROTECTED DIRECTORIES RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}] RewriteRule /?web\.config - [F]