Last active
February 13, 2024 06:32
-
-
Save migliori/1ae6137b8b7009d067fa383e8ce92e3d to your computer and use it in GitHub Desktop.
.htaccess #server #apache
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Apache configuration file | |
# https://gist.github.com/migliori/1ae6137b8b7009d067fa383e8ce92e3d | |
RewriteEngine on | |
RewriteBase / | |
Options +FollowSymLinks | |
# Rewrite to https + www | |
RewriteCond %{REMOTE_ADDR} !127.0.0.1 | |
RewriteCond %{HTTP_HOST} !^www\. | |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] | |
RewriteCond %{REMOTE_ADDR} !127.0.0.1 | |
RewriteCond %{HTTPS} off | |
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] | |
# Remove trailing slash | |
RewriteRule (.*)/$ /$1 [R=301,L] | |
# rewrite all non-existing requests to index.php | |
RewriteCond %{REQUEST_FILENAME} !-f | |
RewriteRule . index.php [L] | |
# ----------------------- | |
# Content-Security-Policy | |
# ----------------------- | |
<IfModule mod_headers.c> | |
# Header set Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.registration.miglisoft.com https://code.jquery.com https://stackpath.bootstrapcdn.com" | |
</IfModule> | |
# ----------- | |
# WEBP images | |
# ----------- | |
<IfModule mod_setenvif.c> | |
# Vary: Accept for all the requests to jpeg and png | |
#SetEnvIf Request_URI "\.(jpe?g|png)$" REQUEST_image | |
</IfModule> | |
<IfModule mod_rewrite.c> | |
# Check if browser supports WebP images | |
RewriteCond %{HTTP_ACCEPT} image/webp | |
RewriteCond %{REMOTE_ADDR} !127.0.0.1 | |
# Serve WebP image instead | |
RewriteRule (.+)\.(jpe?g|png)$ webp_generator.php?file=$1&ext=$2 [T=image/webp,QSA,L] | |
</IfModule> | |
<IfModule mod_headers.c> | |
Header append Vary Accept env=REQUEST_image | |
</IfModule> | |
<IfModule mod_mime.c> | |
AddType image/webp .webp | |
</IfModule> | |
<FilesMatch "\.(ttf|otf|eot|woff|woff2)$"> | |
<IfModule mod_headers.c> | |
Header set Access-Control-Allow-Origin "*" | |
</IfModule> | |
</FilesMatch> | |
# ---------------------------------------------------------------------- | |
# Force Download of files | |
# ---------------------------------------------------------------------- | |
<FilesMatch "\.(?i:docx)$"> | |
ForceType application/octet-stream | |
Header set Content-Disposition attachment | |
</FilesMatch> | |
<FilesMatch "\.(?i:doc)$"> | |
ForceType application/octet-stream | |
Header set Content-Disposition attachment | |
</FilesMatch> | |
<FilesMatch "\.(?i:pdf)$"> | |
ForceType application/octet-stream | |
Header set Content-Disposition attachment | |
</FilesMatch> | |
# ---------------------------------------------------------------------- | |
# CORS-enabled images (@crossorigin) | |
# ---------------------------------------------------------------------- | |
# Send CORS headers if browsers request them; enabled by default for images. | |
# developer.mozilla.org/en/CORS_Enabled_Image | |
# blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html | |
# hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ | |
# wiki.mozilla.org/Security/Reviews/crossoriginAttribute | |
<IfModule mod_setenvif.c> | |
<IfModule mod_headers.c> | |
# mod_headers, y u no match by Content-Type?! | |
<FilesMatch "\.(gif|png|jpe?g|svg|svgz|ico|webp)$"> | |
SetEnvIf Origin ":" IS_CORS | |
Header set Access-Control-Allow-Origin "*" env=IS_CORS | |
</FilesMatch> | |
</IfModule> | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Proper MIME type for all files | |
# ---------------------------------------------------------------------- | |
# JavaScript | |
# Normalize to standard type (it's sniffed in IE anyways) | |
# tools.ietf.org/html/rfc4329#section-7.2 | |
AddType application/javascript js jsonp | |
AddType application/json json | |
# Audio | |
AddType audio/ogg oga ogg | |
AddType audio/mp4 m4a f4a f4b | |
# Video | |
AddType video/ogg ogv | |
AddType video/mp4 mp4 m4v f4v f4p | |
AddType video/webm webm | |
AddType video/x-flv flv | |
# SVG | |
# Required for svg webfonts on iPad | |
# twitter.com/FontSquirrel/status/14855840545 | |
AddType image/svg+xml svg svgz | |
AddEncoding gzip svgz | |
# Webfonts | |
AddType application/vnd.ms-fontobject eot | |
AddType application/x-font-ttf ttf ttc | |
AddType font/opentype otf | |
AddType application/x-font-woff woff | |
AddType application/x-font-woff woff2 | |
# Assorted types | |
AddType image/x-icon ico | |
AddType image/webp webp | |
AddType text/cache-manifest appcache manifest | |
AddType text/x-component htc | |
AddType application/xml rss atom xml rdf | |
AddType application/x-chrome-extension crx | |
AddType application/x-opera-extension oex | |
AddType application/x-xpinstall xpi | |
AddType application/octet-stream safariextz | |
AddType application/manifest+json webapp | |
AddType text/x-vcard vcf | |
AddType application/x-shockwave-flash swf | |
AddType text/vtt vtt | |
# ---------------------------------------------------------------------- | |
# Gzip compression | |
# ---------------------------------------------------------------------- | |
<IfModule mod_deflate.c> | |
# Compress HTML, CSS, JavaScript, Text, XML and fonts | |
AddOutputFilterByType DEFLATE application/javascript | |
AddOutputFilterByType DEFLATE application/rss+xml | |
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject | |
AddOutputFilterByType DEFLATE application/x-font | |
AddOutputFilterByType DEFLATE application/x-font-opentype | |
AddOutputFilterByType DEFLATE application/x-font-otf | |
AddOutputFilterByType DEFLATE application/x-font-truetype | |
AddOutputFilterByType DEFLATE application/x-font-ttf | |
AddOutputFilterByType DEFLATE application/x-javascript | |
AddOutputFilterByType DEFLATE application/xhtml+xml | |
AddOutputFilterByType DEFLATE application/xml | |
AddOutputFilterByType DEFLATE font/opentype | |
AddOutputFilterByType DEFLATE font/otf | |
AddOutputFilterByType DEFLATE font/ttf | |
AddOutputFilterByType DEFLATE image/svg+xml | |
AddOutputFilterByType DEFLATE image/x-icon | |
AddOutputFilterByType DEFLATE text/css | |
AddOutputFilterByType DEFLATE text/html | |
AddOutputFilterByType DEFLATE text/javascript | |
AddOutputFilterByType DEFLATE text/plain | |
AddOutputFilterByType DEFLATE text/xml | |
# Remove browser bugs (only needed for really old browsers) | |
BrowserMatch ^Mozilla/4 gzip-only-text/html | |
BrowserMatch ^Mozilla/4\.0[678] no-gzip | |
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html | |
Header append Vary User-Agent | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Expires headers (for better cache control) | |
# ---------------------------------------------------------------------- | |
# These are pretty far-future expires headers. | |
# They assume you control versioning with filename-based cache busting | |
# Additionally, consider that outdated proxies may miscache | |
# www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ | |
# If you don't use filenames to version, lower the CSS and JS to something like | |
# "access plus 1 week". | |
<IfModule mod_expires.c> | |
ExpiresActive on | |
# Perhaps better to whitelist expires rules? Perhaps. | |
ExpiresDefault "access plus 1 year" | |
# cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) | |
ExpiresByType text/cache-manifest "access plus 0 seconds" | |
# Your document html | |
ExpiresByType text/html "access plus 0 seconds" | |
# Data | |
ExpiresByType text/xml "access plus 0 seconds" | |
ExpiresByType application/xml "access plus 0 seconds" | |
ExpiresByType application/json "access plus 0 seconds" | |
# Feed | |
ExpiresByType application/rss+xml "access plus 1 hour" | |
ExpiresByType application/atom+xml "access plus 1 hour" | |
# Favicon (cannot be renamed) | |
ExpiresByType image/x-icon "access plus 1 week" | |
# Media: images, video, audio | |
ExpiresByType image/x-icon "access plus 1 year" | |
ExpiresByType image/gif "access plus 1 year" | |
ExpiresByType image/png "access plus 1 year" | |
ExpiresByType image/jpeg "access plus 1 year" | |
ExpiresByType video/ogg "access plus 1 year" | |
ExpiresByType audio/ogg "access plus 1 year" | |
ExpiresByType video/mp4 "access plus 1 year" | |
ExpiresByType video/webm "access plus 1 year" | |
# HTC files (css3pie) | |
ExpiresByType text/x-component "access plus 1 year" | |
# Webfonts | |
ExpiresByType application/x-font-ttf "access plus 1 year" | |
ExpiresByType font/opentype "access plus 1 year" | |
ExpiresByType application/x-font-woff "access plus 1 year" | |
ExpiresByType image/svg+xml "access plus 1 year" | |
ExpiresByType application/vnd.ms-fontobject "access plus 1 year" | |
# CSS and JavaScript | |
ExpiresByType text/css "access plus 1 year" | |
ExpiresByType text/javascript "access plus 1 year" | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# Prevent mobile network providers from modifying your site | |
# ---------------------------------------------------------------------- | |
# The following header prevents modification of your code over 3G on some | |
# European providers. | |
# This is the official 'bypass' suggested by O2 in the UK. | |
<IfModule mod_headers.c> | |
Header set Cache-Control "no-transform" | |
</IfModule> | |
# ---------------------------------------------------------------------- | |
# ETag removal | |
# ---------------------------------------------------------------------- | |
# FileETag None is not enough for every server. | |
<IfModule mod_headers.c> | |
Header unset ETag | |
</IfModule> | |
# Since we're sending far-future expires, we don't need ETags for | |
# static content. | |
# developer.yahoo.com/performance/rules.html#etags | |
FileETag None | |
# ---------------------------------------------------------------------- | |
# Prevent 404 errors for non-existing redirected folders | |
# ---------------------------------------------------------------------- | |
# without -MultiViews, Apache will give a 404 for a rewrite if a folder of the | |
# same name does not exist. | |
# webmasterworld.com/apache/3808792.htm | |
Options -MultiViews | |
# ---------------------------------------------------------------------- | |
# UTF-8 encoding | |
# ---------------------------------------------------------------------- | |
# Use UTF-8 encoding for anything served text/plain or text/html | |
AddDefaultCharset utf-8 | |
# Force UTF-8 for a number of file formats | |
AddCharset utf-8 .atom .css .js .json .rss .vtt .xml | |
# ---------------------------------------------------------------------- | |
# A little more security | |
# ---------------------------------------------------------------------- | |
# deny htaccess files | |
<Files ~ "^.*\.([Hh][Tt][Aa])"> | |
order allow,deny | |
deny from all | |
satisfy all | |
</Files> | |
# "-Indexes" will have Apache block users from browsing folders without a | |
# default document Usually you should leave this activated, because you | |
# shouldn't allow everybody to surf through every folder on your server (which | |
# includes rather private places like CMS system folders). | |
<IfModule mod_autoindex.c> | |
Options -Indexes | |
</IfModule> | |
# Block access to "hidden" directories or files whose names begin with a | |
# period. This includes directories used by version control systems such as | |
# Subversion or Git. | |
<IfModule mod_rewrite.c> | |
RewriteCond %{SCRIPT_FILENAME} -d [OR] | |
RewriteCond %{SCRIPT_FILENAME} -f | |
RewriteRule "(^|/)\." - [F] | |
</IfModule> | |
# Block access to backup and source files. These files may be left by some | |
# text/html editors and pose a great security danger, when anyone can access | |
# them. | |
<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$"> | |
Order allow,deny | |
Deny from all | |
Satisfy All | |
</FilesMatch> | |
<IfModule mod_headers.c> | |
Header set X-XSS-Protection "1; mode=block" | |
Header set X-Content-Type-Options "nosniff" | |
</IfModule> | |
# Rename session cookie to something else, than PHPSESSID | |
# php_value session.name sid | |
# Do not show you are using PHP | |
# Note: Move this line to php.ini since it won't work in .htaccess | |
#php_flag expose_php Off | |
# Increase cookie security | |
<IfModule mod_headers.c> | |
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure | |
</IfModule> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment