BakingPlate .htaccess revision

.htaccess

###
### BakingPlate adapting .htaccess from Html5 Boilerplate for use with CakePHP
###

# Media Temple
### Action php5-script /gs-bin/php5-latest
### AddHandler php5-script .php

# 1&1
### AddType x-mapp-php5 .php
### AddHandler x-mapp-php5 .php

###
### Html5 Boilerplate
###

# Apache configuration file
# httpd.apache.org/docs/2.2/mod/quickreference.html

# Note .htaccess files are an overhead, this logic should be in your Apache config if possible
# httpd.apache.org/docs/2.2/howto/htaccess.html

# Techniques in here adapted from all over, including:
# Kroc Camen: camendesign.com/.htaccess
# perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/
# Sample .htaccess file of CMS MODx: modxcms.com

# ----------------------------------------------------------------------
# Better website experience for IE users
# ----------------------------------------------------------------------

# Force the latest IE version, in various cases when it may fall back to IE7 mode
# github.com/rails/rails/commit/123eb25#commitcomment-118920
# Use ChromeFrame if it's installed for a better experience for the poor IE folk

<IfModule mod_setenvif.c>
  <IfModule mod_headers.c>
    BrowserMatch MSIE ie
    Header set X-UA-Compatible "IE=Edge,chrome=1" env=ie
  </IfModule>
</IfModule>

<IfModule mod_headers.c>
# Because X-UA-Compatible isn't sent to non-IE (to save header bytes),
# We need to inform proxies that content changes based on UA
  Header append Vary User-Agent
# Cache control is set only if mod_headers is enabled, so that's unncessary to declare
</IfModule>

# ----------------------------------------------------------------------
# Cross-domain AJAX requests
# ----------------------------------------------------------------------

# Serve cross-domain ajax requests, disabled.
# enable-cors.org
# code.google.com/p/html5security/wiki/CrossOriginRequestSecurity

### <IfModule mod_headers.c>
### Header set Access-Control-Allow-Origin "*"
### </IfModule>

# ----------------------------------------------------------------------
# Webfont access
# ----------------------------------------------------------------------

# allow access from all domains for webfonts
# alternatively you could only whitelist
# your subdomains like "sub.domain.com"

<FilesMatch "\.(ttf|otf|eot|woff|font.css)$">
  <IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
  </IfModule>
</FilesMatch>


# ----------------------------------------------------------------------
# Proper MIME type for all files
# ----------------------------------------------------------------------

# audio
AddType audio/ogg oga ogg

# video
AddType video/ogg ogv
AddType video/mp4 mp4
AddType video/webm webm

# Proper svg serving. Required for svg webfonts on iPad
# twitter.com/FontSquirrel/status/14855840545
AddType image/svg+xml svg svgz
AddEncoding gzip svgz
                                       
# webfonts
AddType application/vnd.ms-fontobject eot
AddType font/truetype ttf
AddType font/opentype otf
AddType application/x-font-woff woff

# assorted types
AddType image/x-icon ico
AddType image/webp webp
AddType text/cache-manifest appcache manifest
AddType text/x-component htc
AddType application/x-chrome-extension crx
AddType application/x-xpinstall xpi
AddType application/octet-stream safariextz
AddType text/x-vcard vcf

# ----------------------------------------------------------------------
# gzip compression
# ----------------------------------------------------------------------

<IfModule mod_deflate.c>


# force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/
<IfModule mod_setenvif.c>
  <IfModule mod_headers.c>
    SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s,?\s(gzip|deflate)?|X{4,13}|~{4,13}|-{4,13})$ HAVE_Accept-Encoding
    RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
  </IfModule>
</IfModule>
# html, txt, css, js, json, xml, htc:
<IfModule filter_module>
  FilterDeclare COMPRESS
  FilterProvider COMPRESS DEFLATE resp=Content-Type /text/(html|css|javascript|plain|x(ml|-component))/
  FilterProvider COMPRESS DEFLATE resp=Content-Type /application/(javascript|json|xml|x-javascript)/
  FilterChain COMPRESS
  FilterProtocol COMPRESS change=yes;byteranges=no
</IfModule>

<IfModule !mod_filter.c>
  # Legacy versions of Apache
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
  AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript
  AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
</IfModule>

# webfonts and svg:
  <FilesMatch "\.(ttf|otf|eot|svg)$" >
    SetOutputFilter DEFLATE
  </FilesMatch>
</IfModule>

# ----------------------------------------------------------------------
# Expires headers (for better cache control)
# ----------------------------------------------------------------------

# these are pretty far-future expires headers
# they assume you control versioning with cachebusting query params like
# <script src="application.js?20100608">
# additionally, consider that outdated proxies may miscache
# www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/

# if you don't use filenames to version, lower the css and js to something like
# "access plus 1 week" or so

<IfModule mod_expires.c>
  ExpiresActive on

# Perhaps better to whitelist expires rules? Perhaps.
  ExpiresDefault "access plus 1 month"

# cache.appcache needs re-requests in FF 3.6 (thx Remy ~Introducing HTML5)
  ExpiresByType text/cache-manifest "access plus 0 seconds"

# your document html
  ExpiresByType text/html "access plus 0 seconds"
  
# data
  ExpiresByType text/xml "access plus 0 seconds"
  ExpiresByType application/xml "access plus 0 seconds"
  ExpiresByType application/json "access plus 0 seconds"

# rss feed
  ExpiresByType application/rss+xml "access plus 1 hour"

# favicon (cannot be renamed)
  ExpiresByType image/x-icon "access plus 1 week"

# media: images, video, audio
  ExpiresByType image/gif "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/jpg "access plus 1 month"
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType video/ogg "access plus 1 month"
  ExpiresByType audio/ogg "access plus 1 month"
  ExpiresByType video/mp4 "access plus 1 month"
  ExpiresByType video/webm "access plus 1 month"
  
# htc files (css3pie)
  ExpiresByType text/x-component "access plus 1 month"
  
# webfonts
  ExpiresByType font/truetype "access plus 1 month"
  ExpiresByType font/opentype "access plus 1 month"
  ExpiresByType application/x-font-woff "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
    
# css and javascript
  ExpiresByType text/css "access plus 2 months"
  ExpiresByType application/javascript "access plus 2 months"
  ExpiresByType text/javascript "access plus 2 months"
  
  <IfModule mod_headers.c>
    Header append Cache-Control "public"
  </IfModule>
  
</IfModule>


# ----------------------------------------------------------------------
# ETag removal
# ----------------------------------------------------------------------

# Since we're sending far-future expires, we don't need ETags for
# static content.
# developer.yahoo.com/performance/rules.html#etags
FileETag None

# ----------------------------------------------------------------------
# Stop screen flicker in IE on CSS rollovers
# ----------------------------------------------------------------------

# The following directives stop screen flicker in IE on CSS rollovers - in
# combination with the "ExpiresByType" rules for images (see above). If
# needed, un-comment the following rules.

### BrowserMatch "MSIE" brokenvary=1
### BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1
### BrowserMatch "Opera" !brokenvary
### SetEnvIf brokenvary 1 force-no-vary

# ----------------------------------------------------------------------
# Cookie setting from iframes
# ----------------------------------------------------------------------

# Allow cookies to be set from iframes (for IE only)
# If needed, uncomment and specify a path or regex in the Location directive

### <IfModule mod_headers.c>
### <Location />
### Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\""
### </Location>
### </IfModule>

# ----------------------------------------------------------------------
# Rewrite 
# ----------------------------------------------------------------------

<IfModule mod_rewrite.c>
  RewriteEngine on
  # Some Servers eg 1&1 and Godaddy need RewriteBase 
  ### RewriteBase /
  
  # ----------------------------------------------------------------------
  # Suppress or force the "www." at the beginning of URLs
  # ----------------------------------------------------------------------
  
  # The same content should never be available under two different URLs - especially not with and
  # without "www." at the beginning, since this can cause SEO problems (duplicate content).
  # That's why you should choose one of the alternatives and redirect the other one.
  
  # By default option 1 (no "www.") is activated. Remember: Shorter URLs are sexier.
  # no-www.org/faq.php?q=class_b
  
  # If you rather want to use option 2, just comment out all option 1 lines
  # and uncomment option 2.
  # IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME!
  
  # ----------------------------------------------------------------------
  
  #|# Option 1:
  # Rewrite "www.domain.com -> domain.com" 
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

  #|# Option 2: (comment out or delete the above option)
  # To rewrite "domain.com -> www.domain.com" uncomment the following lines.
  # Be aware that the following rule might not be a good idea if you
  # use "real" subdomains for certain parts of your website.
  
  ### RewriteCond %{HTTPS} !=on
  ### RewriteCond %{HTTP_HOST} !^www\..+$ [NC]
  ### RewriteCond %{HTTP_HOST} (.+)$ [NC]
  ### RewriteRule ^(.*)$ http://www.%1/$1 [R=301,L]
  
  # ----------------------------------------------------------------------
  # Add/remove trailing slash to (non-file) URLs
  # ----------------------------------------------------------------------
  
  # Google treats URLs with and without trailing slashes separately.
  # Forcing a trailing slash is usually preferred, but all that's really
  # important is that one correctly redirects to the other.
  
  # By default option 1 (force trailing slash) is activated.
  # http://googlewebmastercentral.blogspot.com/2010/04/to-slash-or-not-to-slash.html
  # http://www.alistapart.com/articles/slashforward/
  # http://httpd.apache.org/docs/2.0/misc/rewriteguide.html#url Trailing Slash Problem
  
  # ----------------------------------------------------------------------
  
  #|# Option 1:
  # Rewrite "domain.com/foo -> domain.com/foo/"
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_URI} !(\.[a-zA-Z0-9]{1,5}|/|#(.*))$
  RewriteRule ^(.*)$ $1/ [R=301,L]

  # ----------------------------------------------------------------------
  
  #|# Option 2:
  # Rewrite "domain.com/foo/ -> domain.com/foo"
  ### RewriteRule ^(.*)/$ $1 [R=301,L]

  # for security
  #!#RewriteCond %{REQUEST_METHOD} ^(TRACK|TRACE)
  #!#RewriteRule .* - [F]
  
  # ----------------------------------------------------------------------
  # Prevent SSL cert warnings
  # ----------------------------------------------------------------------
  
  # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent
  # https://www.domain.com when your cert only allows https://secure.domain.com
  # Uncomment the following lines to use this feature.
  
  ### RewriteCond %{SERVER_PORT} !^443
  ### RewriteRule (.*) https://example-domain-please-change-me.com/$1 [R=301,L]
  
  RewriteRule    ^$    webroot/    [L]
  RewriteRule    (.*) webroot/$1    [L]
</IfModule>


# ----------------------------------------------------------------------
# Options
# ----------------------------------------------------------------------
# without -MultiViews, Apache will give a 404 for a rewrite if a folder of the same name does not exist (e.g. “/blog/hello”)
#   webmasterworld.com/apache/3808792.htm
Options FollowSymLinks -MultiViews -Indexes

# ----------------------------------------------------------------------
# UTF-8 encoding
# ----------------------------------------------------------------------

# use utf-8 encoding for anything served text/plain or text/html
AddDefaultCharset utf-8

# force utf-8 for a number of file formats
AddCharset utf-8 .html .css .js .xml .json .rss


# ----------------------------------------------------------------------
# Security
# ----------------------------------------------------------------------

# Block access to "hidden" directories whose names begin with a period. This
# includes directories used by version control systems such as Subversion or Git.
<IfModule mod_rewrite.c>
  RewriteRule "(^|/)\." - [F]
</IfModule>

# Increase cookie security
<IfModule php5_module>
php_value session.cookie_httponly true
</IfModule>