diff --git a/.htaccess b/.htaccess
index 4f3efa5..5c0b656 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,214 +1,67 @@
 # ==================================================
-# WhatsApp Bot Manager - HestiaCP Compatible .htaccess
-# Optimizado para hosting compartido y VPS con HestiaCP
+# WhatsApp Bot Manager - HestiaCP compatible minimal .htaccess
+# Simplified for shared hosting / HestiaCP (avoids server-level directives)
 # ==================================================
 
-# Configuración básica de seguridad
-ServerSignature Off
-
-# Desactivar listado de directorios
+# Seguridad básica
 Options -Indexes
+DirectoryIndex index.php index.html
 
-# Activar RewriteEngine
-RewriteEngine On
+# Activar rewrite (si está disponible)
+<IfModule mod_rewrite.c>
+    RewriteEngine On
 
-# ==================================================
-# PROTECCIÓN DE ARCHIVOS CRÍTICOS
-# ==================================================
+    # Bloquear acceso a directorios de desarrollo y temporales
+    RewriteRule ^(dev|tmp)(/|$) - [F,L]
 
-# Proteger archivos de configuración (compatible con HestiaCP)
+    # Bloquear llamadas sospechosas en query string
+    RewriteCond %{QUERY_STRING} (union|select|insert|delete|drop|create|update|or|and) [NC]
+    RewriteRule .* - [F,L]
+
+    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
+    RewriteRule .* - [F,L]
+
+    RewriteCond %{QUERY_STRING} \.\.\/ [NC]
+    RewriteRule .* - [F,L]
+</IfModule>
+
+# Proteger archivos de configuración
 <FilesMatch "^(config|database|\.env).*\.(php|ini|conf)$">
     Require all denied
 </FilesMatch>
 
-# Proteger archivos sensibles
-<FilesMatch "\.(log|sql|md|txt|json|lock)$">
-    <RequireAll>
-        Require ip 127.0.0.1
-        Require ip ::1
-    </RequireAll>
-</FilesMatch>
-
-# Proteger archivos de instalación después de completada
-<IfModule mod_rewrite.c>
-    RewriteCond %{REQUEST_FILENAME} install.*\.php$ [NC]
-    RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$
-    RewriteCond %{REMOTE_ADDR} !^::1$
-    RewriteRule .* - [F,L]
-</IfModule>
-
-# Proteger archivos dot (ocultos)
+# Proteger archivos ocultos
 <FilesMatch "^\.|\.bak$|\.old$|\.orig$|\.save$|\.swp$|\.tmp$">
     Require all denied
 </FilesMatch>
 
-# ==================================================
-# PROTECCIÓN DE DIRECTORIOS
-# ==================================================
-
-# Proteger directorio de logs
-<IfModule mod_alias.c>
-    RedirectMatch 403 ^/logs/.*$
-</IfModule>
-
-# Proteger directorio de tests (si existe)
-<IfModule mod_alias.c>
-    RedirectMatch 403 ^/tests/.*$
-</IfModule>
-
-# Proteger directorio de desarrollo (dev) y archivos de pruebas
-<IfModule mod_alias.c>
-    RedirectMatch 403 ^/dev/.*$
-</IfModule>
-
-# Proteger directorio temporal
-<IfModule mod_alias.c>
-    RedirectMatch 403 ^/tmp/.*$
-</IfModule>
-
-# ==================================================
-# HEADERS DE SEGURIDAD (Compatible HestiaCP)
-# ==================================================
-
+# Cabeceras de seguridad (si está disponible)
 <IfModule mod_headers.c>
-    # Prevenir clickjacking
     Header always set X-Frame-Options "SAMEORIGIN"
-    
-    # Prevenir XSS
     Header always set X-XSS-Protection "1; mode=block"
-    
-    # Prevenir MIME sniffing
     Header always set X-Content-Type-Options "nosniff"
-    
-    # Política de referrer
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
-    
-    # Content Security Policy básica
-    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' cdn.jsdelivr.net cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net cdnjs.cloudflare.com; font-src 'self' cdnjs.cloudflare.com; img-src 'self' data:; connect-src 'self';"
-    
-    # Permissions Policy
-    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), autoplay=(), fullscreen=()"
 </IfModule>
 
-# ==================================================
-# OPTIMIZACIÓN DE RENDIMIENTO
-# ==================================================
-
-# Compresión GZIP (compatible HestiaCP)
+# Compresión y cache (si están disponibles)
 <IfModule mod_deflate.c>
     <FilesMatch "\.(html|htm|php|css|js|xml|txt|json)$">
         SetOutputFilter DEFLATE
     </FilesMatch>
-    
-    # Excluir archivos ya comprimidos
-    <FilesMatch "\.(zip|gz|rar|7z|jpg|jpeg|png|gif|webp|mp4|mp3|pdf)$">
-        SetEnv no-gzip
-    </FilesMatch>
 </IfModule>
 
-# Cache estático (HestiaCP compatible)
 <IfModule mod_expires.c>
     ExpiresActive On
-    
-    # Archivos CSS y JavaScript
     <FilesMatch "\.(css|js)$">
         ExpiresDefault "access plus 1 month"
     </FilesMatch>
-    
-    # Imágenes
     <FilesMatch "\.(jpg|jpeg|png|gif|webp|svg|ico)$">
         ExpiresDefault "access plus 6 months"
     </FilesMatch>
-    
-    # Fuentes
-    <FilesMatch "\.(woff|woff2|ttf|eot)$">
-        ExpiresDefault "access plus 1 year"
-    </FilesMatch>
 </IfModule>
 
-# ==================================================
-# REGLAS DE REWRITE (HestiaCP)
-# ==================================================
+# Charset por defecto
+AddDefaultCharset UTF-8
 
-# Redirigir HTTP a HTTPS (descomentear en producción)
-# RewriteCond %{HTTPS} off
-# RewriteCond %{HTTP_HOST} !^localhost [NC]
-# RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
-# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
-
-# Redirigir www a no-www (opcional, descomentear si necesario)
-# RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
-# RewriteRule ^(.*)$ https://%1/$1 [R=301,L]
-
-# Página de inicio personalizada
-DirectoryIndex index.php index.html
-
-# ==================================================
-# PROTECCIÓN CONTRA ATAQUES COMUNES
-# ==================================================
-
-# Bloquear injection attempts
-<IfModule mod_rewrite.c>
-    # Bloquear SQL injection
-    RewriteCond %{QUERY_STRING} (union|select|insert|delete|drop|create|update|or|and) [NC]
-    RewriteRule .* - [F,L]
-    
-    # Bloquear XSS
-    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
-    RewriteRule .* - [F,L]
-    
-    # Bloquear file injection
-    RewriteCond %{QUERY_STRING} \.\.\/ [NC]
-    RewriteRule .* - [F,L]
-    
-    # Bloquear acceso a wp-admin (si no es WordPress)
-    RewriteCond %{REQUEST_URI} wp-admin [NC]
-    RewriteRule .* - [F,L]
-</IfModule>
-
-# Limitar tamaño de subida (HestiaCP compatible)
-<IfModule mod_php.c>
-    php_value upload_max_filesize 10M
-    php_value post_max_size 10M
-    php_value max_execution_time 300
-    php_value max_input_vars 3000
-</IfModule>
-
-
-
-# ==================================================
-# CONFIGURACIÓN ESPECÍFICA DE APIs
-# ==================================================
-
-# Headers para APIs JSON
-<FilesMatch "^(api)/.*\.php$">
-    <IfModule mod_headers.c>
-        Header always set Content-Type "application/json; charset=utf-8"
-        Header always set Access-Control-Allow-Origin "*"
-        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
-        Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
-    </IfModule>
-</FilesMatch>
-
-# Webhook específico para WhatsApp
-<Files "webhook.php">
-    <IfModule mod_headers.c>
-        Header always set Access-Control-Allow-Origin "*"
-        Header always set Access-Control-Allow-Methods "GET, POST"
-    </IfModule>
-</Files>
-
-# ==================================================
-# CONFIGURACIÓN DE ERRORES PERSONALIZADA
-# ==================================================
-
-# Páginas de error personalizadas (opcional)
-# ErrorDocument 404 /404.html
-# ErrorDocument 500 /500.html
-# ErrorDocument 403 /403.html
-
-# Ocultar información del servidor
-ServerTokens Prod
-
-# Configuración de charset por defecto
-AddDefaultCharset UTF-8
\ No newline at end of file
+# Nota: ServerTokens y ServerSignature son directivas a nivel de servidor y no están permitidas en .htaccess en muchos entornos.
+# Si necesitas esas opciones, configúralas en la configuración global de Apache (httpd.conf/extra) o solicita al proveedor que lo ajuste.