-
-
Save abaumer/0065bdea840d85477248 to your computer and use it in GitHub Desktop.
Basic htaccess based on Paul's. Extra stuff I didn't need removed. No WP in this one.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#Boilerplate------------------------------------ | |
# Apache configuration file | |
# httpd.apache.org/docs/2.2/mod/quickreference.html | |
# Note .htaccess files are an overhead, this logic should be in your Apache | |
# config if possible: httpd.apache.org/docs/2.2/howto/htaccess.html | |
# Techniques in here adapted from all over, including: | |
# Kroc Camen: camendesign.com/.htaccess | |
# perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/ | |
# Sample .htaccess file of CMS MODx: modxcms.com | |
# ---------------------------------------------------------------------- | |
# Better website experience for IE users | |
# ---------------------------------------------------------------------- | |
# Force the latest IE version, in various cases when it may fall back to IE7 mode | |
# github.com/rails/rails/commit/123eb25#commitcomment-118920 | |
# Use ChromeFrame if it's installed for a better experience for the poor IE folk | |
<IfModule mod_headers.c> | |
Header set X-UA-Compatible "IE=Edge,chrome=1" | |
# mod_headers can't match by content-type, but we don't want to send this header on *everything*... | |
<FilesMatch "\.(appcache|crx|css|eot|gif|htc|ico|jpe?g|js|m4a|m4v|manifest|mp4|oex|oga|ogg|ogv|otf|pdf|png|safariextz|svg|svgz|ttf|vcf|webm|webp|woff|xml|xpi)$"> | |
Header unset X-UA-Compatible | |
</FilesMatch> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Webfont access | |
# ---------------------------------------------------------------------- | |
# Allow access from all domains for webfonts. | |
# Alternatively you could only whitelist your | |
# subdomains like "subdomain.example.com". | |
<IfModule mod_headers.c> | |
<FilesMatch "\.(eot|font.css|otf|ttc|ttf|woff)$"> | |
Header set Access-Control-Allow-Origin "*" | |
</FilesMatch> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Proper MIME type for all files | |
# ---------------------------------------------------------------------- | |
# JavaScript | |
# Normalize to standard type (it's sniffed in IE anyways) | |
# tools.ietf.org/html/rfc4329#section-7.2 | |
AddType application/javascript js jsonp | |
AddType application/json json | |
# Audio | |
AddType audio/mp4 m4a f4a f4b | |
AddType audio/ogg oga ogg | |
# Video | |
AddType video/mp4 mp4 m4v f4v f4p | |
AddType video/ogg ogv | |
AddType video/webm webm | |
AddType video/x-flv flv | |
# SVG | |
# Required for svg webfonts on iPad | |
# twitter.com/FontSquirrel/status/14855840545 | |
AddType image/svg+xml svg svgz | |
AddEncoding gzip svgz | |
# Webfonts | |
AddType application/vnd.ms-fontobject eot | |
AddType application/x-font-ttf ttf ttc | |
AddType application/x-font-woff woff | |
AddType font/opentype otf | |
# Assorted types | |
AddType application/octet-stream safariextz | |
AddType application/x-chrome-extension crx | |
AddType application/x-opera-extension oex | |
AddType application/x-shockwave-flash swf | |
AddType application/x-web-app-manifest+json webapp | |
AddType application/x-xpinstall xpi | |
AddType application/xml rss atom xml rdf | |
AddType image/webp webp | |
AddType image/x-icon ico | |
AddType text/cache-manifest appcache manifest | |
AddType text/vtt vtt | |
AddType text/x-component htc | |
AddType text/x-vcard vcf | |
# ---------------------------------------------------------------------- | |
# Gzip compression | |
# ---------------------------------------------------------------------- | |
<IfModule mod_deflate.c> | |
# Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ | |
<IfModule mod_setenvif.c> | |
<IfModule mod_headers.c> | |
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding | |
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding | |
</IfModule> | |
</IfModule> | |
# Compress all output labeled with one of the following MIME-types | |
# (for Apache versions below 2.3.7, you don't need to enable `mod_filter` | |
# and can remove the `<IfModule mod_filter.c>` and `</IfModule>` lines as | |
# `AddOutputFilterByType` is still in the core directives) | |
#################### | |
# GZIP COMPRESSION # | |
#################### | |
SetOutputFilter DEFLATE | |
AddOutputFilterByType DEFLATE text/html text/css text/plain text/xml application/x-javascript application/x-httpd-php | |
BrowserMatch ^Mozilla/4 gzip-only-text/html | |
BrowserMatch ^Mozilla/4\.0[678] no-gzip | |
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html | |
BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html | |
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip | |
Header append Vary User-Agent env=!dont-vary | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Expires headers (for better cache control) | |
# ---------------------------------------------------------------------- | |
# These are pretty far-future expires headers. | |
# They assume you control versioning with filename-based cache busting | |
# Additionally, consider that outdated proxies may miscache | |
# www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ | |
# If you don't use filenames to version, lower the CSS and JS to something like | |
# "access plus 1 week". | |
<IfModule mod_expires.c> | |
ExpiresActive on | |
# Perhaps better to whitelist expires rules? Perhaps. | |
ExpiresDefault "access plus 1 month" | |
# cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) | |
ExpiresByType text/cache-manifest "access plus 0 seconds" | |
# Your document html | |
ExpiresByType text/html "access plus 0 seconds" | |
# Data | |
ExpiresByType application/json "access plus 0 seconds" | |
ExpiresByType application/xml "access plus 0 seconds" | |
ExpiresByType text/xml "access plus 0 seconds" | |
# Feed | |
ExpiresByType application/atom+xml "access plus 1 hour" | |
ExpiresByType application/rss+xml "access plus 1 hour" | |
# Favicon (cannot be renamed) | |
ExpiresByType image/x-icon "access plus 1 week" | |
# Media: images, video, audio | |
ExpiresByType audio/ogg "access plus 1 month" | |
ExpiresByType image/gif "access plus 1 month" | |
ExpiresByType image/jpeg "access plus 1 month" | |
ExpiresByType image/png "access plus 1 month" | |
ExpiresByType video/mp4 "access plus 1 month" | |
ExpiresByType video/ogg "access plus 1 month" | |
ExpiresByType video/webm "access plus 1 month" | |
# HTC files (css3pie) | |
ExpiresByType text/x-component "access plus 1 month" | |
# Webfonts | |
ExpiresByType application/vnd.ms-fontobject "access plus 1 month" | |
ExpiresByType application/x-font-ttf "access plus 1 month" | |
ExpiresByType application/x-font-woff "access plus 1 month" | |
ExpiresByType font/opentype "access plus 1 month" | |
ExpiresByType image/svg+xml "access plus 1 month" | |
# CSS and JavaScript | |
ExpiresByType application/javascript "access plus 1 year" | |
ExpiresByType text/css "access plus 1 year" | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Start rewrite engine | |
# ---------------------------------------------------------------------- | |
# Turning on the rewrite engine is necessary for the following rules and | |
# features. FollowSymLinks must be enabled for this to work. | |
# Some cloud hosting services require RewriteBase to be set: goo.gl/HOcPN | |
# If using the h5bp in a subdirectory, use `RewriteBase /foo` instead where | |
# 'foo' is your directory. | |
# If your web host doesn't allow the FollowSymlinks option, you may need to | |
# comment it out and use `Options +SymLinksIfOwnerMatch`, but be aware of the | |
# performance impact: http://goo.gl/Mluzd | |
<IfModule mod_rewrite.c> | |
Options +FollowSymlinks | |
# Options +SymLinksIfOwnerMatch | |
RewriteEngine On | |
# RewriteBase / | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Suppress or force the "www." at the beginning of URLs | |
# ---------------------------------------------------------------------- | |
# The same content should never be available under two different URLs - | |
# especially not with and without "www." at the beginning, since this can cause | |
# SEO problems (duplicate content). That's why you should choose one of the | |
# alternatives and redirect the other one. | |
# By default option 1 (no "www.") is activated. | |
# no-www.org/faq.php?q=class_b | |
# If you'd prefer to use option 2, just comment out all option 1 lines | |
# and uncomment option 2. | |
# IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME! | |
# ---------------------------------------------------------------------- | |
# Option 1: | |
# Rewrite "www.example.com -> example.com". | |
<IfModule mod_rewrite.c> | |
RewriteCond %{HTTPS} !=on | |
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] | |
RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L] | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Option 2: | |
# Rewrite "example.com -> www.example.com". | |
# Be aware that the following rule might not be a good idea if you use "real" | |
# subdomains for certain parts of your website. | |
# <IfModule mod_rewrite.c> | |
# RewriteCond %{HTTPS} !=on | |
# RewriteCond %{HTTP_HOST} !^www\..+$ [NC] | |
# RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] | |
# </IfModule> | |
# ---------------------------------------------------------------------- | |
# Built-in filename-based cache busting | |
# ---------------------------------------------------------------------- | |
# If you're not using the build script to manage your filename version revving, | |
# you might want to consider enabling this, which will route requests for | |
# `/css/style.20110203.css` to `/css/style.css`. | |
# To understand why this is important and a better idea than all.css?v1231, | |
# please refer to the bundled documentation about `.htaccess`. | |
# <IfModule mod_rewrite.c> | |
# RewriteCond %{REQUEST_FILENAME} !-f | |
# RewriteCond %{REQUEST_FILENAME} !-d | |
# RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L] | |
# </IfModule> | |
# ---------------------------------------------------------------------- | |
# Prevent 404 errors for non-existing redirected folders | |
# ---------------------------------------------------------------------- | |
# without -MultiViews, Apache will give a 404 for a rewrite if a folder of the | |
# same name does not exist. | |
# webmasterworld.com/apache/3808792.htm | |
Options -MultiViews | |
# ---------------------------------------------------------------------- | |
# Custom 404 page | |
# ---------------------------------------------------------------------- | |
# You can add custom pages to handle 500 or 403 pretty easily, if you like. | |
# If you are hosting your site in subdirectory, adjust this accordingly | |
# e.g. ErrorDocument 404 /subdir/404.html | |
# ErrorDocument 404 /404.html | |
# OR redirect back home | |
ErrorDocument 404 /index.html | |
# ---------------------------------------------------------------------- | |
# UTF-8 encoding | |
# ---------------------------------------------------------------------- | |
# Use UTF-8 encoding for anything served text/plain or text/html | |
AddDefaultCharset utf-8 | |
# Force UTF-8 for a number of file formats | |
AddCharset utf-8 .atom .css .js .json .rss .vtt .xml | |
# ---------------------------------------------------------------------- | |
# A little more security | |
# ---------------------------------------------------------------------- | |
# To avoid displaying the exact version number of Apache being used, add the | |
# following to httpd.conf (it will not work in .htaccess): | |
# ServerTokens Prod | |
# "-Indexes" will have Apache block users from browsing folders without a | |
# default document Usually you should leave this activated, because you | |
# shouldn't allow everybody to surf through every folder on your server (which | |
# includes rather private places like CMS system folders). | |
<IfModule mod_autoindex.c> | |
Options -Indexes | |
</IfModule> | |
# Block access to "hidden" directories or files whose names begin with a | |
# period. This includes directories used by version control systems such as | |
# Subversion or Git. | |
<IfModule mod_rewrite.c> | |
RewriteCond %{SCRIPT_FILENAME} -d [OR] | |
RewriteCond %{SCRIPT_FILENAME} -f | |
RewriteRule "(^|/)\." - [F] | |
</IfModule> | |
# Block access to backup and source files. These files may be left by some | |
# text/html editors and pose a great security danger, when anyone can access | |
# them. | |
<FilesMatch "(\.(bak|config|dist|fla|inc|ini|log|psd|sh|sql|swp)|~)$"> | |
Order allow,deny | |
Deny from all | |
Satisfy All | |
</FilesMatch> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment