<?php
/**
* This file is created by Really Simple SSL
*/

if ( isset($_GET["rsssl_header_test"]) && (int) $_GET["rsssl_header_test"] ===  503150189 ) return;

if (defined("RSSSL_HEADERS_ACTIVE")) return;
define("RSSSL_HEADERS_ACTIVE", true);
//RULES START

if ( !headers_sent() ) {
header("X-XSS-Protection: 0");
header("X-Content-Type-Options: nosniff");
header("Referrer-Policy: strict-origin-when-cross-origin");

if (function_exists('header_remove')) {
    header_remove('X-Powered-By');
} else {
    header('X-Powered-By: ');
}

header("Content-Security-Policy: upgrade-insecure-requests; ");

}

//disable http methods
$is_rest_request = isset($_SERVER["REQUEST_URI"]) && strpos($_SERVER["REQUEST_URI"], "wp-json/")!==false && isset($_SERVER["HTTP_X_WP_NONCE"]);
$is_rest_request = $is_rest_request || isset($_SERVER["REQUEST_URI"]) && strpos($_SERVER["REQUEST_URI"], "admin-ajax.php")!==false;
if ( !$is_rest_request ) {
	$current_method = isset($_SERVER["REQUEST_METHOD"]) ? $_SERVER["REQUEST_METHOD"]: false;
	if( !in_array($current_method, ["GET", "POST", "HEAD", "OPTIONS"]) ){
		$serverProtocol = isset($_SERVER["SERVER_PROTOCOL"]) ? $_SERVER["SERVER_PROTOCOL"] : "HTTP/1.1";
		header($serverProtocol." 405 Method Not Allowed", true, 405);
		exit;
	}
}