# MINIMAL SAFE .htaccess
# Only the CSP header needed for the sports Live Preview iframe.
# Everything else (rewrites, security blocks) is removed so this file
# CANNOT cause a 500 on the whole site. Re-add carefully once the site
# is confirmed working.

<IfModule mod_headers.c>
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.googleapis.com https://sport-tv-guide.live; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com https://sport-tv-guide.live; img-src 'self' data: https:; connect-src 'self' https:; object-src 'none'; frame-src 'self' https://sport-tv-guide.live; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
</IfModule>
