.htaccess

Options -Indexes

# ---
# Uncomment these lines to change PHP parameters if you are using the PHP Apache module
# ---
#<IfModule mod_php5.c>
#	php_value max_execution_time 200
#	php_value post_max_size 200M
#	php_value upload_max_size 200M
#	php_value upload_max_filesize 20M
#	php_value max_file_uploads 100
#</IfModule>
<IfModule mod_php7.c>
	php_value max_execution_time 200
	php_value post_max_size 500M
	php_value upload_max_filesize 500M
	php_value max_file_uploads 100
</IfModule>

# ---
# Uncomment these lines when you want to allow access to the Lychee API from different origins
# ---
#Header add Access-Control-Allow-Origin "*"
#Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
#Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

<IfModule mod_headers.c>
	# Here we set CSP for Lychee. The first option is fairly forgiving. The second is stricter, but *should* still work.
	# Additionally, you may wish to set up a report-uri.
	Header set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.dropbox.com; connect-src 'self' https://lycheeorg.github.io; form-action 'none'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content;"
	# Header set Content-Security-Policy "default-src 'none'; style-src 'self'; script-src 'self' https://www.dropbox.com; connect-src 'self' https://lycheeorg.github.io; img-src 'self'; media-src 'self'; prefetch-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content;"
</IfModule>