[Jon]

Looks like you have CDSEO and Clean Urls enabled or at least you still have the clean urls code in your .htaccess.

Ensure that Clean Urls is disabled in your xcart admin -> general settings -> SEO settings area.

Then ensure that CDSEO is enabled.

Then use this as your .htaccess:

<Files 403.shtml>
order allow,deny
allow from all
</Files>
<FilesMatch "\.(css|js)$">
Allow from all
</FilesMatch>

# ------------------------------------
# CDSEO Pro
# ------------------------------------
# This directory index is recommended to replace the
# x-cart default within this .htaccess file
DirectoryIndex home.php index.html index.php

# Enable mod rewrite engine
RewriteEngine On

# .htpasswd protection
# May be required if your htpasswd files are located below document root (i.e. cpanel)
# Remove # at the beginning of this line if your unable to access password protected folders:
ErrorDocument 401 "Unauthorized"

# Some servers require this Options directive to be disabled
# Remove # at the beginning of this line to disable:
Options +FollowSymLinks -MultiViews -Indexes

# Some servers require the Rewritebase directive to be enabled
# Remove # at the beginning of this line to enable:
RewriteBase /

# Speed-Up JS and CSS
RewriteRule loader_(.+).css loader.php?type=css&md5_suffix=$1 [L]
RewriteRule loader_(.+).js loader.php?type=js&md5_suffix=$1 [L]

# Url Parsing
RewriteCond %{REQUEST_URI} !^/(payment|admin|provider|partner)/
RewriteCond %{REQUEST_FILENAME} !\.(gif|jpe?g|png|js|css|swf|php|ico)$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.+)$ cdseopro.php
# ------------------------------------
# / CDSEO Pro
# ------------------------------------


# block common X-Cart files that could reveal
# that you have X-Cart installed
RedirectMatch gone ^.*Smarty.*$ 
RedirectMatch gone ^/.*\.tpl$ 
RedirectMatch gone VERSION.*
RedirectMatch gone COPYRIGHT.*
RedirectMatch gone INSTALL.*
RedirectMatch gone NEW.*
RedirectMatch gone README.*
RedirectMatch gone UPGRADE.*
Redirect gone /shipping 
Redirect gone /skin_backup 
Redirect gone /.pgp 
Redirect gone /.pgp.def

ServerSignature Off
#Block mySQL injects
RewriteCond %{QUERY_STRING} (;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|updat e|md5|benchmark) [NC,OR]
RewriteCond %{QUERY_STRING} \.\./\.\. [OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} \.[a-z0-9] [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC]
RewriteRule .* index.php [F]