Basic .htaccess starter file

.htaccess

# Optionially turn off Entity Tags
Header unset Pragma
FileETag None
Header unset ETag

#-------------------------------------------------------------------------------------------------

# Suppress or force the www. at the beginning of URLs

# Option 1:
# Rewrite "www.example.com -> example.com"

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

# Option 2:
# Rewrite "example.com -> www.example.com"
# Be aware that the following rule might not be a good idea if you
# use "real" subdomains for certain parts of your website.

# RewriteEngine On
# RewriteCond %{HTTPS} !=on
# RewriteCond %{HTTP_HOST} !^www\..+$ [NC]
# RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

#-------------------------------------------------------------------------------------------------

# "-Indexes" will have Apache block users from browsing folders without a default document
# Usually you should leave this activated, because you shouldn't allow everybody to surf through
# every folder on your server (which includes rather private places like CMS system folders).
<IfModule mod_autoindex.c>
	Options -Indexes
</IfModule>

#-------------------------------------------------------------------------------------------------

# Block access to "hidden" directories or files whose names begin with a period. This
# includes directories used by version control systems such as Subversion or Git.
<IfModule mod_rewrite.c>
	RewriteCond %{SCRIPT_FILENAME} -d [OR]
	RewriteCond %{SCRIPT_FILENAME} -f
	RewriteRule "(^|/)\." - [F]
</IfModule>

#-------------------------------------------------------------------------------------------------

# Block access to backup and source files
# These files may be left by some text/html editors and
# pose a great security danger, when anyone can access them
<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$">
	Order allow,deny
	Deny from all
	Satisfy All
</FilesMatch>

#-------------------------------------------------------------------------------------------------

<IfModule mod_expires.c>
	ExpiresActive On

	# Perhaps better to whitelist expires rules? Perhaps.
	ExpiresDefault      "access plus 1 month"

	# cache.appcache needs re-requests
	ExpiresByType text/cache-manifest "access plus 0 seconds"

	# Your document html
	ExpiresByType text/html "access plus 0 seconds"

	# Data
	ExpiresByType text/xml "access plus 0 seconds"
	ExpiresByType application/xml "access plus 0 seconds"
	ExpiresByType application/json "access plus 0 seconds"

	# RSS feed
	ExpiresByType application/rss+xml "access plus 1 hour"

	# Favicon (cannot be renamed)
	ExpiresByType image/x-icon "access plus 1 week"

	# Media: images, video, audio
	ExpiresByType image/gif "access plus 1 month"
	ExpiresByType image/png "access plus 1 month"
	ExpiresByType image/jpg "access plus 1 month"
	ExpiresByType image/jpeg "access plus 1 month"
	ExpiresByType video/ogg "access plus 1 month"
	ExpiresByType audio/ogg "access plus 1 month"
	ExpiresByType video/mp4 "access plus 1 month"
	ExpiresByType video/webm "access plus 1 month"

	# HTC files  (css3pie)
	ExpiresByType text/x-component "access plus 1 month"

	# Webfonts
	ExpiresByType font/truetype "access plus 1 month"
	ExpiresByType font/opentype "access plus 1 month"
	ExpiresByType application/x-font-woff   "access plus 1 month"
	ExpiresByType image/svg+xml "access plus 1 month"
	ExpiresByType application/vnd.ms-fontobject "access plus 1 month"

	# CSS and JavaScript
	ExpiresByType text/css "access plus 1 year"
	ExpiresByType application/javascript "access plus 1 year"
	ExpiresByType text/javascript "access plus 1 year"

	<IfModule mod_headers.c>
		Header append Cache-Control "public"
	</IfModule>
</IfModule>

#-------------------------------------------------------------------------------------------------

#Gzip
<IfModule mod_deflate.c>
	<FilesMatch "\.(js|css|html|jpg|jpeg|png|gif)$">
		SetOutputFilter DEFLATE
	</FilesMatch>
</IfModule>