path correction

public/.htaccess

@@ -1,15 +1,30 @@
 # Deployed under /citpl_website/ on Apache.
-# Requires: mod_rewrite, mod_headers, and (for API) mod_proxy + mod_proxy_http
+# Requires: mod_rewrite, mod_headers, PHP curl
+# API: PHP proxy to Node on 127.0.0.1:3001 (start with: npm run server / pm2)
 
-RewriteEngine On
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  RewriteBase /citpl_website/
 
-# Proxy Node API + uploads (start server with: node server/index.js)
-RewriteRule ^api/(.*)$ http://127.0.0.1:3001/api/$1 [P,L]
-RewriteRule ^uploads/(.*)$ http://127.0.0.1:3001/uploads/$1 [P,L]
+  # API -> PHP proxy (works without mod_proxy)
+  RewriteRule ^api(?:/.*)?$ api/index.php [QSA,L]
 
-# Allow admin login/section preview to iframe this page (same origin)
-<Files "preview.html">
-  Header always unset X-Frame-Options
-  Header always unset Content-Security-Policy
-  Header always set Content-Security-Policy "frame-ancestors 'self'"
-</Files>
+  # Uploads -> PHP proxy
+  RewriteRule ^uploads/(.*)$ uploads-proxy.php?file=$1 [QSA,L]
+</IfModule>
+
+# Host security headers use frame-ancestors 'none' + X-Frame-Options DENY.
+# Edit them so admin can embed preview.html (same origin).
+<IfModule mod_headers.c>
+  Header always edit Content-Security-Policy "frame-ancestors 'none'" "frame-ancestors 'self'"
+  Header always edit X-Frame-Options "DENY" "SAMEORIGIN"
+
+  <FilesMatch "^(preview\.html|preview\.php|index\.html)$">
+    Header unset X-Frame-Options
+    Header always unset X-Frame-Options
+    Header unset Content-Security-Policy
+    Header always unset Content-Security-Policy
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set Content-Security-Policy "frame-ancestors 'self'"
+  </FilesMatch>
+</IfModule>