Created
April 4, 2023 12:52
-
-
Save HashandSalt/78ec477f2fc7687c26c1946dbc91774a to your computer and use it in GitHub Desktop.
.htaccess
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Kirby .htaccess | |
# rewrite rules | |
<IfModule mod_rewrite.c> | |
# enable awesome urls. i.e.: | |
# http://yourdomain.com/about-us/team | |
RewriteEngine on | |
RewriteCond %{HTTP_HOST} !=localhost | |
RewriteCond %{HTTP_HOST} ^www\. [NC,OR] | |
RewriteCond %{HTTPS} off | |
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC] | |
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE] | |
RewriteCond %{REQUEST_FILENAME} !-f | |
RewriteRule ^(.+)\.(\d+)\.(js|css)$ $1.$3 [L] | |
# make sure to set the RewriteBase correctly | |
# if you are running the site in a subfolder. | |
# Otherwise links or the entire site will break. | |
# | |
# If your homepage is http://yourdomain.com/mysite | |
# Set the RewriteBase to: | |
# | |
# RewriteBase /mysite | |
# In some enviroments it's necessary to | |
# set the RewriteBase to: | |
# | |
# RewriteBase / | |
# block files and folders beginning with a dot, such as .git | |
# except for the .well-known folder, which is used for Let's Encrypt and security.txt | |
RewriteRule (^|/)\.(?!well-known\/) index.php [L] | |
# block text files in the content folder from being accessed directly | |
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L] | |
# block all files in the site folder from being accessed directly | |
# except for requests to plugin assets files | |
RewriteRule ^site/(.*) index.php [L] | |
# Enable authentication header | |
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 | |
# block direct access to kirby and the panel sources | |
RewriteRule ^kirby/(.*) index.php [L] | |
# make site links work | |
RewriteCond %{REQUEST_FILENAME} !-f | |
RewriteCond %{REQUEST_FILENAME} !-d | |
RewriteRule ^(.*) index.php [L] | |
</IfModule> | |
# ###################################################################### | |
# # CROSS-ORIGIN # | |
# ###################################################################### | |
# ---------------------------------------------------------------------- | |
# | Cross-origin requests | | |
# ---------------------------------------------------------------------- | |
# Allow cross-origin requests. | |
# | |
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS | |
# http://enable-cors.org/ | |
# http://www.w3.org/TR/cors/ | |
# <IfModule mod_headers.c> | |
# Header set Access-Control-Allow-Origin "*" | |
# </IfModule> | |
# ---------------------------------------------------------------------- | |
# | Cross-origin images | | |
# ---------------------------------------------------------------------- | |
# Send the CORS header for images when browsers request it. | |
# | |
# https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image | |
# https://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html | |
<IfModule mod_setenvif.c> | |
<IfModule mod_headers.c> | |
<FilesMatch "\.(bmp|cur|gif|ico|jpe?g|png|svgz?|webp)$"> | |
SetEnvIf Origin ":" IS_CORS | |
Header set Access-Control-Allow-Origin "*" env=IS_CORS | |
</FilesMatch> | |
</IfModule> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Cross-origin web fonts | | |
# ---------------------------------------------------------------------- | |
# Allow cross-origin access to web fonts. | |
<IfModule mod_headers.c> | |
<FilesMatch "\.(eot|otf|tt[cf]|woff2?)$"> | |
Header set Access-Control-Allow-Origin "*" | |
</FilesMatch> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Cross-origin resource timing | | |
# ---------------------------------------------------------------------- | |
# Allow cross-origin access to the timing information for all resources. | |
# | |
# If a resource isn't served with a `Timing-Allow-Origin` header that | |
# would allow its timing information to be shared with the document, | |
# some of the attributes of the `PerformanceResourceTiming` object will | |
# be set to zero. | |
# | |
# http://www.w3.org/TR/resource-timing/ | |
# http://www.stevesouders.com/blog/2014/08/21/resource-timing-practical-tips/ | |
# <IfModule mod_headers.c> | |
# Header set Timing-Allow-Origin: "*" | |
# </IfModule> | |
# ---------------------------------------------------------------------- | |
# | Error prevention | | |
# ---------------------------------------------------------------------- | |
# Disable the pattern matching based on filenames. | |
# | |
# This setting prevents Apache from returning a 404 error as the result | |
# of a rewrite when the directory with the same name does not exist. | |
# | |
# https://httpd.apache.org/docs/current/content-negotiation.html#multiviews | |
Options -MultiViews | |
# ---------------------------------------------------------------------- | |
# | Media types | | |
# ---------------------------------------------------------------------- | |
# Serve resources with the proper media types (f.k.a. MIME types). | |
# | |
# https://www.iana.org/assignments/media-types/media-types.xhtml | |
# https://httpd.apache.org/docs/current/mod/mod_mime.html#addtype | |
<IfModule mod_mime.c> | |
# Data interchange | |
AddType application/atom+xml atom | |
AddType application/json json map topojson | |
AddType application/ld+json jsonld | |
AddType application/rss+xml rss | |
AddType application/vnd.geo+json geojson | |
AddType application/xml rdf xml | |
# JavaScript | |
# Normalize to standard type. | |
# https://tools.ietf.org/html/rfc4329#section-7.2 | |
AddType application/javascript js | |
# Manifest files | |
AddType application/manifest+json webmanifest | |
AddType application/x-web-app-manifest+json webapp | |
AddType text/cache-manifest appcache | |
# Media files | |
AddType audio/mp4 f4a f4b m4a | |
AddType audio/ogg oga ogg opus | |
AddType image/bmp bmp | |
AddType image/svg+xml svg svgz | |
AddType image/webp webp | |
AddType video/mp4 mp4 f4v f4p m4v | |
AddType video/ogg ogv | |
AddType video/webm webm | |
AddType video/x-flv flv | |
AddType audio/mpeg mp3 | |
# Serving `.ico` image files with a different media type | |
# prevents Internet Explorer from displaying then as images: | |
# https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee | |
AddType image/x-icon cur ico | |
# Web fonts | |
AddType application/font-woff woff | |
AddType application/font-woff2 woff2 | |
AddType application/vnd.ms-fontobject eot | |
# Browsers usually ignore the font media types and simply sniff | |
# the bytes to figure out the font type. | |
# https://mimesniff.spec.whatwg.org/#matching-a-font-type-pattern | |
# | |
# However, Blink and WebKit based browsers will show a warning | |
# in the console if the following font types are served with any | |
# other media types. | |
AddType application/x-font-ttf ttc ttf | |
AddType font/opentype otf | |
# Other | |
AddType application/octet-stream safariextz | |
AddType application/x-bb-appworld bbaw | |
AddType application/x-chrome-extension crx | |
AddType application/x-opera-extension oex | |
AddType application/x-xpinstall xpi | |
AddType text/vcard vcard vcf | |
AddType text/vnd.rim.location.xloc xloc | |
AddType text/vtt vtt | |
AddType text/x-component htc | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Character encodings | | |
# ---------------------------------------------------------------------- | |
# Serve all resources labeled as `text/html` or `text/plain` | |
# with the media type `charset` parameter set to `UTF-8`. | |
# | |
# https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset | |
AddDefaultCharset utf-8 | |
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
# Serve the following file types with the media type `charset` | |
# parameter set to `UTF-8`. | |
# | |
# https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset | |
<IfModule mod_mime.c> | |
AddCharset utf-8 .atom \ | |
.bbaw \ | |
.css \ | |
.geojson \ | |
.js \ | |
.json \ | |
.jsonld \ | |
.manifest \ | |
.rdf \ | |
.rss \ | |
.topojson \ | |
.vtt \ | |
.webapp \ | |
.webmanifest \ | |
.xloc \ | |
.xml | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Clickjacking | | |
# ---------------------------------------------------------------------- | |
# Protect website against clickjacking. | |
# | |
# The example below sends the `X-Frame-Options` response header with | |
# the value `DENY`, informing browsers not to display the content of | |
# the web page in any frame. | |
# | |
# This might not be the best setting for everyone. You should read | |
# about the other two possible values the `X-Frame-Options` header | |
# field can have: `SAMEORIGIN` and `ALLOW-FROM`. | |
# https://tools.ietf.org/html/rfc7034#section-2.1. | |
# | |
# Keep in mind that while you could send the `X-Frame-Options` header | |
# for all of your website’s pages, this has the potential downside that | |
# it forbids even non-malicious framing of your content (e.g.: when | |
# users visit your website using a Google Image Search results page). | |
# | |
# Nonetheless, you should ensure that you send the `X-Frame-Options` | |
# header for all pages that allow a user to make a state changing | |
# operation (e.g: pages that contain one-click purchase links, checkout | |
# or bank-transfer confirmation pages, pages that make permanent | |
# configuration changes, etc.). | |
# | |
# Sending the `X-Frame-Options` header can also protect your website | |
# against more than just clickjacking attacks: | |
# https://cure53.de/xfo-clickjacking.pdf. | |
# | |
# https://tools.ietf.org/html/rfc7034 | |
# http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx | |
# https://www.owasp.org/index.php/Clickjacking | |
<IfModule mod_headers.c> | |
Header set X-Frame-Options "DENY" | |
# `mod_headers` cannot match based on the content-type, however, | |
# the `X-Frame-Options` response header should be send only for | |
# HTML documents and not for the other resources. | |
<FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$"> | |
Header unset X-Frame-Options | |
</FilesMatch> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Content Security Policy (CSP) | | |
# ---------------------------------------------------------------------- | |
# Mitigate the risk of cross-site scripting and other content-injection | |
# attacks. | |
# | |
# This can be done by setting a `Content Security Policy` which | |
# whitelists trusted sources of content for your website. | |
# | |
# The example header below allows ONLY scripts that are loaded from | |
# the current website's origin (no inline scripts, no CDN, etc). | |
# That almost certainly won't work as-is for your website! | |
# | |
# To make things easier, you can use an online CSP header generator | |
# such as: http://cspisawesome.com/. | |
# | |
# http://content-security-policy.com/ | |
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/ | |
# http://www.w3.org/TR/CSP11/). | |
# <IfModule mod_headers.c> | |
# | |
# Header set Content-Security-Policy "script-src https://analytics.hashandsalt.com/matomo.js 'unsafe-inline' 'self'; object-src 'self'" | |
# | |
# # `mod_headers` cannot match based on the content-type, however, | |
# # the `Content-Security-Policy` response header should be send | |
# # only for HTML documents and not for the other resources. | |
# | |
# <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$"> | |
# Header unset Content-Security-Policy | |
# </FilesMatch> | |
# | |
# </IfModule> | |
# ---------------------------------------------------------------------- | |
# | File access | | |
# ---------------------------------------------------------------------- | |
# Block access to directories without a default document. | |
# | |
# You should leave the following uncommented, as you shouldn't allow | |
# anyone to surf through every directory on your server (which may | |
# includes rather private places such as the CMS's directories). | |
<IfModule mod_autoindex.c> | |
Options -Indexes | |
</IfModule> | |
# Block access to files that can expose sensitive information. | |
# | |
# By default, block access to backup and source files that may be | |
# left by some text editors and can pose a security risk when anyone | |
# has access to them. | |
# | |
# http://feross.org/cmsploit/ | |
# | |
# (!) Update the `<FilesMatch>` regular expression from below to | |
# include any files that might end up on your production server and | |
# can expose sensitive information about your website. These files may | |
# include: configuration files, files that contain metadata about the | |
# project (e.g.: project dependencies), build scripts, etc.. | |
<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$"> | |
# Apache < 2.3 | |
<IfModule !mod_authz_core.c> | |
Order allow,deny | |
Deny from all | |
Satisfy All | |
</IfModule> | |
# Apache ≥ 2.3 | |
<IfModule mod_authz_core.c> | |
Require all denied | |
</IfModule> | |
</FilesMatch> | |
# ---------------------------------------------------------------------- | |
# | Reducing MIME type security risks | | |
# ---------------------------------------------------------------------- | |
# Prevent some browsers from MIME-sniffing the response. | |
# | |
# This reduces exposure to drive-by download attacks and cross-origin | |
# data leaks, and should be left uncommented, especially if the server | |
# is serving user-uploaded content or content that could potentially be | |
# treated as executable by the browser. | |
# | |
# http://www.slideshare.net/hasegawayosuke/owasp-hasegawa | |
# http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx | |
# https://msdn.microsoft.com/en-us/library/ie/gg622941.aspx | |
# https://mimesniff.spec.whatwg.org/ | |
<IfModule mod_headers.c> | |
Header set X-Content-Type-Options "nosniff" | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Reflected Cross-Site Scripting (XSS) attacks | | |
# ---------------------------------------------------------------------- | |
# (1) Try to re-enable the cross-site scripting (XSS) filter built | |
# into most web browsers. | |
# | |
# The filter is usually enabled by default, but in some cases it | |
# may be disabled by the user. However, in Internet Explorer for | |
# example, it can be re-enabled just by sending the | |
# `X-XSS-Protection` header with the value of `1`. | |
# | |
# (2) Prevent web browsers from rendering the web page if a potential | |
# reflected (a.k.a non-persistent) XSS attack is detected by the | |
# filter. | |
# | |
# By default, if the filter is enabled and browsers detect a | |
# reflected XSS attack, they will attempt to block the attack | |
# by making the smallest possible modifications to the returned | |
# web page. | |
# | |
# Unfortunately, in some browsers (e.g.: Internet Explorer), | |
# this default behavior may allow the XSS filter to be exploited, | |
# thereby, it's better to inform browsers to prevent the rendering | |
# of the page altogether, instead of attempting to modify it. | |
# | |
# https://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities | |
# | |
# (!) Do not rely on the XSS filter to prevent XSS attacks! Ensure that | |
# you are taking all possible measures to prevent XSS attacks, the | |
# most obvious being: validating and sanitizing your website's inputs. | |
# | |
# http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx | |
# http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx | |
# https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 | |
<IfModule mod_headers.c> | |
# (1) (2) | |
Header set X-XSS-Protection "1; mode=block" | |
# `mod_headers` cannot match based on the content-type, however, | |
# the `X-XSS-Protection` response header should be send only for | |
# HTML documents and not for the other resources. | |
<FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$"> | |
Header unset X-XSS-Protection | |
</FilesMatch> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Server-side technology information | | |
# ---------------------------------------------------------------------- | |
# Remove the `X-Powered-By` response header that: | |
# | |
# * is set by some frameworks and server-side languages | |
# (e.g.: ASP.NET, PHP), and its value contains information | |
# about them (e.g.: their name, version number) | |
# | |
# * doesn't provide any value as far as users are concern, | |
# and in some cases, the information provided by it can | |
# be used by attackers | |
# | |
# (!) If you can, you should disable the `X-Powered-By` header from the | |
# language / framework level (e.g.: for PHP, you can do that by setting | |
# `expose_php = off` in `php.ini`) | |
# | |
# https://php.net/manual/en/ini.core.php#ini.expose-php | |
<IfModule mod_headers.c> | |
Header unset X-Powered-By | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Server software information | | |
# ---------------------------------------------------------------------- | |
# Prevent Apache from adding a trailing footer line containing | |
# information about the server to the server-generated documents | |
# (e.g.: error messages, directory listings, etc.) | |
# | |
# https://httpd.apache.org/docs/current/mod/core.html#serversignature | |
ServerSignature Off | |
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
# Prevent Apache from sending in the `Server` response header its | |
# exact version number, the description of the generic OS-type or | |
# information about its compiled-in modules. | |
# | |
# (!) The `ServerTokens` directive will only work in the main server | |
# configuration file, so don't try to enable it in the `.htaccess` file! | |
# | |
# https://httpd.apache.org/docs/current/mod/core.html#servertokens | |
#ServerTokens Prod | |
# ---------------------------------------------------------------------- | |
# | Compression | | |
# ---------------------------------------------------------------------- | |
<IfModule mod_deflate.c> | |
# Force compression for mangled `Accept-Encoding` request headers | |
# https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html | |
<IfModule mod_setenvif.c> | |
<IfModule mod_headers.c> | |
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding | |
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding | |
</IfModule> | |
</IfModule> | |
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
# Compress all output labeled with one of the following media types. | |
# | |
# (!) For Apache versions below version 2.3.7 you don't need to | |
# enable `mod_filter` and can remove the `<IfModule mod_filter.c>` | |
# and `</IfModule>` lines as `AddOutputFilterByType` is still in | |
# the core directives. | |
# | |
# https://httpd.apache.org/docs/current/mod/mod_filter.html#addoutputfilterbytype | |
<IfModule mod_filter.c> | |
AddOutputFilterByType DEFLATE "application/atom+xml" \ | |
"application/javascript" \ | |
"application/json" \ | |
"application/ld+json" \ | |
"application/manifest+json" \ | |
"application/rdf+xml" \ | |
"application/rss+xml" \ | |
"application/schema+json" \ | |
"application/vnd.geo+json" \ | |
"application/vnd.ms-fontobject" \ | |
"application/x-font-ttf" \ | |
"application/x-javascript" \ | |
"application/x-web-app-manifest+json" \ | |
"application/xhtml+xml" \ | |
"application/xml" \ | |
"font/eot" \ | |
"font/opentype" \ | |
"image/bmp" \ | |
"image/svg+xml" \ | |
"image/vnd.microsoft.icon" \ | |
"image/x-icon" \ | |
"text/cache-manifest" \ | |
"text/css" \ | |
"text/html" \ | |
"text/javascript" \ | |
"text/plain" \ | |
"text/vcard" \ | |
"text/vnd.rim.location.xloc" \ | |
"text/vtt" \ | |
"text/x-component" \ | |
"text/x-cross-domain-policy" \ | |
"text/xml" | |
</IfModule> | |
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
# Map the following filename extensions to the specified | |
# encoding type in order to make Apache serve the file types | |
# with the appropriate `Content-Encoding` response header | |
# (do note that this will NOT make Apache compress them!). | |
# | |
# If these files types would be served without an appropriate | |
# `Content-Enable` response header, client applications (e.g.: | |
# browsers) wouldn't know that they first need to uncompress | |
# the response, and thus, wouldn't be able to understand the | |
# content. | |
# | |
# https://httpd.apache.org/docs/current/mod/mod_mime.html#addencoding | |
<IfModule mod_mime.c> | |
AddEncoding gzip svgz | |
</IfModule> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | Content transformation | | |
# ---------------------------------------------------------------------- | |
# Prevent intermediate caches or proxies (e.g.: such as the ones | |
# used by mobile network providers) from modifying the website's | |
# content. | |
# | |
# https://tools.ietf.org/html/rfc2616#section-14.9.5 | |
# | |
# (!) If you are using `mod_pagespeed`, please note that setting | |
# the `Cache-Control: no-transform` response header will prevent | |
# `PageSpeed` from rewriting `HTML` files, and, if the | |
# `ModPagespeedDisableRewriteOnNoTransform` directive isn't set | |
# to `off`, also from rewriting other resources. | |
# | |
# https://developers.google.com/speed/pagespeed/module/configuration#notransform | |
<IfModule mod_headers.c> | |
Header merge Cache-Control "no-transform" | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# | ETags | | |
# ---------------------------------------------------------------------- | |
# Remove `ETags` as resources are sent with far-future expires headers. | |
# | |
# https://developer.yahoo.com/performance/rules.html#etags | |
# https://tools.ietf.org/html/rfc7232#section-2.3 | |
# `FileETag None` doesn't work in all cases. | |
<IfModule mod_headers.c> | |
Header unset ETag | |
<filesMatch "\.(svg|webp|jpg|jpeg|png|gif|ico|mp4|ttf|woff|woff2)$"> | |
Header set Cache-Control "max-age=31536000, public" | |
</filesMatch> | |
<filesMatch "\.(css)$"> | |
Header set Cache-Control "max-age=31536000, public" | |
</filesMatch> | |
<filesMatch "\.(js)$"> | |
Header set Cache-Control "max-age=31536000, private" | |
</filesMatch> | |
<filesMatch "\.(x?html?|php)$"> | |
Header set Cache-Control "max-age=420, private, must-revalidate" | |
</filesMatch> | |
FileETag None | |
</IfModule> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment