This area is intentionally open for ESP32 device traffic.
The admin interface lives at /admin/index.php and should be protected with Apache Basic Auth.
API endpoints are available under /api/device/check.php, /api/device/report.php, /api/device/firmware.php, and /api/device/file.php.