# cPanel-safe: this application uses direct PHP URLs and no rewrite rules.
# Restricted shared-hosting accounts can reject Options/RewriteEngine with 500.

# The dedicated embed endpoint must be frameable by external websites/apps.
# Guarded with mod_headers so hosts without that module do not error.
<IfModule mod_headers.c>
    <Files "embed.php">
        Header always unset X-Frame-Options
        Header always set Content-Security-Policy "frame-ancestors *"
    </Files>
</IfModule>
