diff --git a/public_html/api.php b/public_html/api.php
index 4c53dd1..8214fe7 100644
--- a/public_html/api.php
+++ b/public_html/api.php
@@ -8,7 +8,13 @@ require_once __DIR__ . '/../api/config.php';
 require_once __DIR__ . '/../api/lib/db.php';
 require_once __DIR__ . '/../api/lib/kb_engine.php';
 
-session_start();
+// Skip session for agent/netscan/ping — each heartbeat would otherwise create
+// an empty session file, producing millions of files that slow session GC for all requests.
+$_earlyParts = explode('/', trim(parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH), '/'));
+if (($_earlyParts[0] ?? '') === 'api') array_shift($_earlyParts);
+if (!in_array($_earlyParts[0] ?? '', ['agent','netscan','ping'], true)) {
+    session_start();
+}
 
 header('Content-Type: application/json');
 header('Access-Control-Allow-Origin: *');