.htaccess

<ifModule mod_headers.c>
  Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE"
</ifModule>

DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # PROTECTED DIRECTORIES
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^/?(data|api)/ - [F]

  RewriteRule ^/?data/config\.php$ - [F]
  RewriteRule ^/?data/logs/ - [F]
  RewriteRule ^/?data/cache/ - [F]
  RewriteRule ^/?data/upload/ - [F]
  RewriteRule ^/?data/\.backup/ - [F]
  RewriteRule ^/?application/ - [F]
  RewriteRule ^/?custom/ - [F]
  RewriteRule ^/?vendor/ - [F]
  #END PROTECTED DIRECTORIES

  RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]

  RewriteRule reset/?$ reset.html [QSA,L]
</IfModule>