oritromax · May 18, 2015 17:41 · asifsaho · Jul 10, 2015
diff --git a/.htaccess b/.htaccess
 <IfModule mod_setenvif.c>
    <IfModule mod_headers.c>
        <FilesMatch "\.(bmp|cur|gif|ico|jpe?g|png|svgz?|webp)$">
            SetEnvIf Origin ":" IS_CORS
            Header set Access-Control-Allow-Origin "*" env=IS_CORS
        </FilesMatch>
    </IfModule>
 </IfModule>

 <IfModule mod_headers.c>
    <FilesMatch "\.(eot|otf|tt[cf]|woff2?)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
 </IfModule>

 ErrorDocument 404 /404.html

 Options -MultiViews

 <IfModule mod_headers.c>

    Header set X-UA-Compatible "IE=edge"

    <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
        Header unset X-UA-Compatible
    </FilesMatch>

 </IfModule>

 <IfModule mod_mime.c>

  # Data interchange

    AddType application/atom+xml                        atom
    AddType application/json                            json map topojson
    AddType application/ld+json                         jsonld
    AddType application/rss+xml                         rss
    AddType application/vnd.geo+json                    geojson
    AddType application/xml                             rdf xml


  # JavaScript

    # Normalize to standard type.
    # https://tools.ietf.org/html/rfc4329#section-7.2

    AddType application/javascript                      js


  # Manifest files

    AddType application/manifest+json                   webmanifest
    AddType application/x-web-app-manifest+json         webapp
    AddType text/cache-manifest                         appcache


  # Media files

    AddType audio/mp4                                   f4a f4b m4a
    AddType audio/ogg                                   oga ogg opus
    AddType image/bmp                                   bmp
    AddType image/svg+xml                               svg svgz
    AddType image/webp                                  webp
    AddType video/mp4                                   f4v f4p m4v mp4
    AddType video/ogg                                   ogv
    AddType video/webm                                  webm
    AddType video/x-flv                                 flv

    # Serving `.ico` image files with a different media type
    # prevents Internet Explorer from displaying then as images:
    # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee

    AddType image/x-icon                                cur ico


  # Web fonts

    AddType application/font-woff                       woff
    AddType application/font-woff2                      woff2
    AddType application/vnd.ms-fontobject               eot
    AddType application/x-font-ttf                      ttc ttf
    AddType font/opentype                               otf


  # Other

    AddType application/octet-stream                    safariextz
    AddType application/x-bb-appworld                   bbaw
    AddType application/x-chrome-extension              crx
    AddType application/x-opera-extension               oex
    AddType application/x-xpinstall                     xpi
    AddType text/vcard                                  vcard vcf
    AddType text/vnd.rim.location.xloc                  xloc
    AddType text/vtt                                    vtt
    AddType text/x-component                            htc

 </IfModule>

 AddDefaultCharset utf-8

 <IfModule mod_mime.c>
    AddCharset utf-8 .atom \
                     .bbaw \
                     .css \
                     .geojson \
                     .js \
                     .json \
                     .jsonld \
                     .manifest \
                     .rdf \
                     .rss \
                     .topojson \
                     .vtt \
                     .webapp \
                     .webmanifest \
                     .xloc \
                     .xml
 </IfModule>

 <IfModule mod_rewrite.c>

    # (1)
    RewriteEngine On

    # (2)
    Options +FollowSymlinks

    # (3)
    # Options +SymLinksIfOwnerMatch

    # (4)
    # RewriteBase /

    # (5)
    # RewriteOptions <options>

    # (6)
    RewriteCond %{HTTPS} =on
    RewriteRule ^ - [env=proto:https]
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ - [env=proto:http]

 </IfModule>

 # ----------------------------------------------------------------------
 # | Forcing `https://`                                                 |
 # ----------------------------------------------------------------------

 # Redirect from the `http://` to the `https://` version of the URL.
 # https://wiki.apache.org/httpd/RewriteHTTPToHTTPS

 # <IfModule mod_rewrite.c>
 #    RewriteEngine On
 #    RewriteCond %{HTTPS} !=on
 #    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
 # </IfModule>

 <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
 </IfModule>

 # Option 2: rewrite example.com → www.example.com
 #
 # Be aware that the following might not be a good idea if you use "real"
 # subdomains for certain parts of your website.

 # <IfModule mod_rewrite.c>
 #     RewriteEngine On
 #     RewriteCond %{HTTPS} !=on
 #     RewriteCond %{HTTP_HOST} !^www\. [NC]
 #     RewriteCond %{SERVER_ADDR} !=127.0.0.1
 #     RewriteCond %{SERVER_ADDR} !=::1
 #     RewriteRule ^ %{ENV:PROTO}://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 # </IfModule>


 # <IfModule mod_headers.c>

 #     Header set X-Frame-Options "DENY"

 #     # `mod_headers` cannot match based on the content-type, however,
 #     # the `X-Frame-Options` response header should be send only for
 #     # HTML documents and not for the other resources.

 #     <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
 #         Header unset X-Frame-Options
 #     </FilesMatch>

 # </IfModule>

 # <IfModule mod_headers.c>

 #     Header set Content-Security-Policy "script-src 'self'; object-src 'self'"

 #     # `mod_headers` cannot match based on the content-type, however,
 #     # the `Content-Security-Policy` response header should be send
 #     # only for HTML documents and not for the other resources.

 #     <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
 #         Header unset Content-Security-Policy
 #     </FilesMatch>

 # </IfModule>

 <IfModule mod_autoindex.c>
    Options -Indexes
 </IfModule>

 <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
    RewriteCond %{SCRIPT_FILENAME} -d [OR]
    RewriteCond %{SCRIPT_FILENAME} -f
    RewriteRule "(^|/)\." - [F]
 </IfModule>

 <FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$">

    # Apache < 2.3
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
        Satisfy All
    </IfModule>

    # Apache ≥ 2.3
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>

 </FilesMatch>

 <IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
 </IfModule>

 # <IfModule mod_headers.c>

 #     #                           (1)    (2)
 #     Header set X-XSS-Protection "1; mode=block"

 #     # `mod_headers` cannot match based on the content-type, however,
 #     # the `X-XSS-Protection` response header should be send only for
 #     # HTML documents and not for the other resources.

 #     <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
 #         Header unset X-XSS-Protection
 #     </FilesMatch>

 # </IfModule>

 <IfModule mod_headers.c>
    Header unset X-Powered-By
 </IfModule>

 ServerSignature Off



 <IfModule mod_deflate.c>

    # Force compression for mangled `Accept-Encoding` request headers
    # https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html

    <IfModule mod_setenvif.c>
        <IfModule mod_headers.c>
            SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
            RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
        </IfModule>
    </IfModule>

    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE "application/atom+xml" \
                                      "application/javascript" \
                                      "application/json" \
                                      "application/ld+json" \
                                      "application/manifest+json" \
                                      "application/rdf+xml" \
                                      "application/rss+xml" \
                                      "application/schema+json" \
                                      "application/vnd.geo+json" \
                                      "application/vnd.ms-fontobject" \
                                      "application/x-font-ttf" \
                                      "application/x-javascript" \
                                      "application/x-web-app-manifest+json" \
                                      "application/xhtml+xml" \
                                      "application/xml" \
                                      "font/eot" \
                                      "font/opentype" \
                                      "image/bmp" \
                                      "image/svg+xml" \
                                      "image/vnd.microsoft.icon" \
                                      "image/x-icon" \
                                      "text/cache-manifest" \
                                      "text/css" \
                                      "text/html" \
                                      "text/javascript" \
                                      "text/plain" \
                                      "text/vcard" \
                                      "text/vnd.rim.location.xloc" \
                                      "text/vtt" \
                                      "text/x-component" \
                                      "text/x-cross-domain-policy" \
                                      "text/xml"

    </IfModule>

    <IfModule mod_mime.c>
        AddEncoding gzip              svgz
    </IfModule>

 </IfModule>

 <IfModule mod_headers.c>
    Header unset ETag
 </IfModule>

 FileETag None

 <IfModule mod_expires.c>

    ExpiresActive on
    ExpiresDefault                                      "access plus 1 month"

  # CSS

    ExpiresByType text/css                              "access plus 1 year"


  # Data interchange

    ExpiresByType application/atom+xml                  "access plus 1 hour"
    ExpiresByType application/rdf+xml                   "access plus 1 hour"
    ExpiresByType application/rss+xml                   "access plus 1 hour"

    ExpiresByType application/json                      "access plus 0 seconds"
    ExpiresByType application/ld+json                   "access plus 0 seconds"
    ExpiresByType application/schema+json               "access plus 0 seconds"
    ExpiresByType application/vnd.geo+json              "access plus 0 seconds"
    ExpiresByType application/xml                       "access plus 0 seconds"
    ExpiresByType text/xml                              "access plus 0 seconds"


  # Favicon (cannot be renamed!) and cursor images

    ExpiresByType image/vnd.microsoft.icon              "access plus 1 week"
    ExpiresByType image/x-icon                          "access plus 1 week"

  # HTML

    ExpiresByType text/html                             "access plus 0 seconds"


  # JavaScript

    ExpiresByType application/javascript                "access plus 1 year"
    ExpiresByType application/x-javascript              "access plus 1 year"
    ExpiresByType text/javascript                       "access plus 1 year"


  # Manifest files

    ExpiresByType application/manifest+json             "access plus 1 week"
    ExpiresByType application/x-web-app-manifest+json   "access plus 0 seconds"
    ExpiresByType text/cache-manifest                   "access plus 0 seconds"


  # Media files

    ExpiresByType audio/ogg                             "access plus 1 month"
    ExpiresByType image/bmp                             "access plus 1 month"
    ExpiresByType image/gif                             "access plus 1 month"
    ExpiresByType image/jpeg                            "access plus 1 month"
    ExpiresByType image/png                             "access plus 1 month"
    ExpiresByType image/svg+xml                         "access plus 1 month"
    ExpiresByType image/webp                            "access plus 1 month"
    ExpiresByType video/mp4                             "access plus 1 month"
    ExpiresByType video/ogg                             "access plus 1 month"
    ExpiresByType video/webm                            "access plus 1 month"


  # Web fonts

    # Embedded OpenType (EOT)
    ExpiresByType application/vnd.ms-fontobject         "access plus 1 month"
    ExpiresByType font/eot                              "access plus 1 month"

    # OpenType
    ExpiresByType font/opentype                         "access plus 1 month"

    # TrueType
    ExpiresByType application/x-font-ttf                "access plus 1 month"

    # Web Open Font Format (WOFF) 1.0
    ExpiresByType application/font-woff                 "access plus 1 month"
    ExpiresByType application/x-font-woff               "access plus 1 month"
    ExpiresByType font/woff                             "access plus 1 month"

    # Web Open Font Format (WOFF) 2.0
    ExpiresByType application/font-woff2                "access plus 1 month"


  # Other

    ExpiresByType text/x-cross-domain-policy            "access plus 1 week"

 </IfModule>

 # Allow concatenation from within specific files.
 #
 # e.g.:
 #
 #   If you have the following lines in a file called, for
 #   example, `main.combined.js`:
 #
 #       <!--#include file="js/jquery.js" -->
 #       <!--#include file="js/jquery.timer.js" -->
 #
 #   Apache will replace those lines with the content of the
 #   specified files.

 # <IfModule mod_include.c>
 #     <FilesMatch "\.combined\.js$">
 #         Options +Includes
 #         AddOutputFilterByType INCLUDES application/javascript \
 #                                        application/x-javascript \
 #                                        text/javascript
 #         SetOutputFilter INCLUDES
 #     </FilesMatch>
 #     <FilesMatch "\.combined\.css$">
 #         Options +Includes
 #         AddOutputFilterByType INCLUDES text/css
 #         SetOutputFilter INCLUDES
 #     </FilesMatch>
 # </IfModule>


 # <IfModule mod_rewrite.c>
 #     RewriteEngine On
 #     RewriteCond %{REQUEST_FILENAME} !-f
 #     RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]
 # </IfModule>
	<IfModule mod_setenvif.c>
	<IfModule mod_headers.c>
	<FilesMatch "\.(bmp\|cur\|gif\|ico\|jpe?g\|png\|svgz?\|webp)$">
	SetEnvIf Origin ":" IS_CORS
	Header set Access-Control-Allow-Origin "*" env=IS_CORS
	</FilesMatch>
	</IfModule>
	</IfModule>

	<IfModule mod_headers.c>
	<FilesMatch "\.(eot\|otf\|tt[cf]\|woff2?)$">
	Header set Access-Control-Allow-Origin "*"
	</FilesMatch>
	</IfModule>

	ErrorDocument 404 /404.html

	Options -MultiViews

	<IfModule mod_headers.c>

	Header set X-UA-Compatible "IE=edge"

	<FilesMatch "\.(appcache\|atom\|bbaw\|bmp\|crx\|css\|cur\|eot\|f4[abpv]\|flv\|geojson\|gif\|htc\|ico\|jpe?g\|js\|json(ld)?\|m4[av]\|manifest\|map\|mp4\|oex\|og[agv]\|opus\|otf\|pdf\|png\|rdf\|rss\|safariextz\|svgz?\|swf\|topojson\|tt[cf]\|txt\|vcard\|vcf\|vtt\|webapp\|web[mp]\|webmanifest\|woff2?\|xloc\|xml\|xpi)$">
	Header unset X-UA-Compatible
	</FilesMatch>

	</IfModule>

	<IfModule mod_mime.c>

	# Data interchange

	AddType application/atom+xml atom
	AddType application/json json map topojson
	AddType application/ld+json jsonld
	AddType application/rss+xml rss
	AddType application/vnd.geo+json geojson
	AddType application/xml rdf xml


	# JavaScript

	# Normalize to standard type.
	# https://tools.ietf.org/html/rfc4329#section-7.2

	AddType application/javascript js


	# Manifest files

	AddType application/manifest+json webmanifest
	AddType application/x-web-app-manifest+json webapp
	AddType text/cache-manifest appcache


	# Media files

	AddType audio/mp4 f4a f4b m4a
	AddType audio/ogg oga ogg opus
	AddType image/bmp bmp
	AddType image/svg+xml svg svgz
	AddType image/webp webp
	AddType video/mp4 f4v f4p m4v mp4
	AddType video/ogg ogv
	AddType video/webm webm
	AddType video/x-flv flv

	# Serving `.ico` image files with a different media type
	# prevents Internet Explorer from displaying then as images:
	# https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee

	AddType image/x-icon cur ico


	# Web fonts

	AddType application/font-woff woff
	AddType application/font-woff2 woff2
	AddType application/vnd.ms-fontobject eot
	AddType application/x-font-ttf ttc ttf
	AddType font/opentype otf


	# Other

	AddType application/octet-stream safariextz
	AddType application/x-bb-appworld bbaw
	AddType application/x-chrome-extension crx
	AddType application/x-opera-extension oex
	AddType application/x-xpinstall xpi
	AddType text/vcard vcard vcf
	AddType text/vnd.rim.location.xloc xloc
	AddType text/vtt vtt
	AddType text/x-component htc

	</IfModule>

	AddDefaultCharset utf-8

	<IfModule mod_mime.c>
	AddCharset utf-8 .atom \
	.bbaw \
	.css \
	.geojson \
	.js \
	.json \
	.jsonld \
	.manifest \
	.rdf \
	.rss \
	.topojson \
	.vtt \
	.webapp \
	.webmanifest \
	.xloc \
	.xml
	</IfModule>

	<IfModule mod_rewrite.c>

	# (1)
	RewriteEngine On

	# (2)
	Options +FollowSymlinks

	# (3)
	# Options +SymLinksIfOwnerMatch

	# (4)
	# RewriteBase /

	# (5)
	# RewriteOptions <options>

	# (6)
	RewriteCond %{HTTPS} =on
	RewriteRule ^ - [env=proto:https]
	RewriteCond %{HTTPS} !=on
	RewriteRule ^ - [env=proto:http]

	</IfModule>

	# ----------------------------------------------------------------------
	# \| Forcing `https://` \|
	# ----------------------------------------------------------------------

	# Redirect from the `http://` to the `https://` version of the URL.
	# https://wiki.apache.org/httpd/RewriteHTTPToHTTPS

	# <IfModule mod_rewrite.c>
	# RewriteEngine On
	# RewriteCond %{HTTPS} !=on
	# RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
	# </IfModule>

	<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{HTTPS} !=on
	RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
	RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
	</IfModule>

	# Option 2: rewrite example.com → www.example.com
	#
	# Be aware that the following might not be a good idea if you use "real"
	# subdomains for certain parts of your website.

	# <IfModule mod_rewrite.c>
	# RewriteEngine On
	# RewriteCond %{HTTPS} !=on
	# RewriteCond %{HTTP_HOST} !^www\. [NC]
	# RewriteCond %{SERVER_ADDR} !=127.0.0.1
	# RewriteCond %{SERVER_ADDR} !=::1
	# RewriteRule ^ %{ENV:PROTO}://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
	# </IfModule>


	# <IfModule mod_headers.c>

	# Header set X-Frame-Options "DENY"

	# # `mod_headers` cannot match based on the content-type, however,
	# # the `X-Frame-Options` response header should be send only for
	# # HTML documents and not for the other resources.

	# <FilesMatch "\.(appcache\|atom\|bbaw\|bmp\|crx\|css\|cur\|eot\|f4[abpv]\|flv\|geojson\|gif\|htc\|ico\|jpe?g\|js\|json(ld)?\|m4[av]\|manifest\|map\|mp4\|oex\|og[agv]\|opus\|otf\|pdf\|png\|rdf\|rss\|safariextz\|svgz?\|swf\|topojson\|tt[cf]\|txt\|vcard\|vcf\|vtt\|webapp\|web[mp]\|webmanifest\|woff2?\|xloc\|xml\|xpi)$">
	# Header unset X-Frame-Options
	# </FilesMatch>

	# </IfModule>

	# <IfModule mod_headers.c>

	# Header set Content-Security-Policy "script-src 'self'; object-src 'self'"

	# # `mod_headers` cannot match based on the content-type, however,
	# # the `Content-Security-Policy` response header should be send
	# # only for HTML documents and not for the other resources.

	# <FilesMatch "\.(appcache\|atom\|bbaw\|bmp\|crx\|css\|cur\|eot\|f4[abpv]\|flv\|geojson\|gif\|htc\|ico\|jpe?g\|js\|json(ld)?\|m4[av]\|manifest\|map\|mp4\|oex\|og[agv]\|opus\|otf\|pdf\|png\|rdf\|rss\|safariextz\|svgz?\|swf\|topojson\|tt[cf]\|txt\|vcard\|vcf\|vtt\|webapp\|web[mp]\|webmanifest\|woff2?\|xloc\|xml\|xpi)$">
	# Header unset Content-Security-Policy
	# </FilesMatch>

	# </IfModule>

	<IfModule mod_autoindex.c>
	Options -Indexes
	</IfModule>

	<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_URI} "!(^\|/)\.well-known/([^./]+./?)+$" [NC]
	RewriteCond %{SCRIPT_FILENAME} -d [OR]
	RewriteCond %{SCRIPT_FILENAME} -f
	RewriteRule "(^\|/)\." - [F]
	</IfModule>

	<FilesMatch "(^#.*#\|\.(bak\|conf\|dist\|fla\|in[ci]\|log\|psd\|sh\|sql\|sw[op])\|~)$">

	# Apache < 2.3
	<IfModule !mod_authz_core.c>
	Order allow,deny
	Deny from all
	Satisfy All
	</IfModule>

	# Apache ≥ 2.3
	<IfModule mod_authz_core.c>
	Require all denied
	</IfModule>

	</FilesMatch>

	<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	</IfModule>

	# <IfModule mod_headers.c>

	# # (1) (2)
	# Header set X-XSS-Protection "1; mode=block"

	# # `mod_headers` cannot match based on the content-type, however,
	# # the `X-XSS-Protection` response header should be send only for
	# # HTML documents and not for the other resources.

	# <FilesMatch "\.(appcache\|atom\|bbaw\|bmp\|crx\|css\|cur\|eot\|f4[abpv]\|flv\|geojson\|gif\|htc\|ico\|jpe?g\|js\|json(ld)?\|m4[av]\|manifest\|map\|mp4\|oex\|og[agv]\|opus\|otf\|pdf\|png\|rdf\|rss\|safariextz\|svgz?\|swf\|topojson\|tt[cf]\|txt\|vcard\|vcf\|vtt\|webapp\|web[mp]\|webmanifest\|woff2?\|xloc\|xml\|xpi)$">
	# Header unset X-XSS-Protection
	# </FilesMatch>

	# </IfModule>

	<IfModule mod_headers.c>
	Header unset X-Powered-By
	</IfModule>

	ServerSignature Off



	<IfModule mod_deflate.c>

	# Force compression for mangled `Accept-Encoding` request headers
	# https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html

	<IfModule mod_setenvif.c>
	<IfModule mod_headers.c>
	SetEnvIfNoCase ^(Accept-EncodXng\|X-cept-Encoding\|X{15}\|~{15}\|-{15})$ ^((gzip\|deflate)\s,?\s)+\|[X~-]{4,13}$ HAVE_Accept-Encoding
	RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
	</IfModule>
	</IfModule>

	<IfModule mod_filter.c>
	AddOutputFilterByType DEFLATE "application/atom+xml" \
	"application/javascript" \
	"application/json" \
	"application/ld+json" \
	"application/manifest+json" \
	"application/rdf+xml" \
	"application/rss+xml" \
	"application/schema+json" \
	"application/vnd.geo+json" \
	"application/vnd.ms-fontobject" \
	"application/x-font-ttf" \
	"application/x-javascript" \
	"application/x-web-app-manifest+json" \
	"application/xhtml+xml" \
	"application/xml" \
	"font/eot" \
	"font/opentype" \
	"image/bmp" \
	"image/svg+xml" \
	"image/vnd.microsoft.icon" \
	"image/x-icon" \
	"text/cache-manifest" \
	"text/css" \
	"text/html" \
	"text/javascript" \
	"text/plain" \
	"text/vcard" \
	"text/vnd.rim.location.xloc" \
	"text/vtt" \
	"text/x-component" \
	"text/x-cross-domain-policy" \
	"text/xml"

	</IfModule>

	<IfModule mod_mime.c>
	AddEncoding gzip svgz
	</IfModule>

	</IfModule>

	<IfModule mod_headers.c>
	Header unset ETag
	</IfModule>

	FileETag None

	<IfModule mod_expires.c>

	ExpiresActive on
	ExpiresDefault "access plus 1 month"

	# CSS

	ExpiresByType text/css "access plus 1 year"


	# Data interchange

	ExpiresByType application/atom+xml "access plus 1 hour"
	ExpiresByType application/rdf+xml "access plus 1 hour"
	ExpiresByType application/rss+xml "access plus 1 hour"

	ExpiresByType application/json "access plus 0 seconds"
	ExpiresByType application/ld+json "access plus 0 seconds"
	ExpiresByType application/schema+json "access plus 0 seconds"
	ExpiresByType application/vnd.geo+json "access plus 0 seconds"
	ExpiresByType application/xml "access plus 0 seconds"
	ExpiresByType text/xml "access plus 0 seconds"


	# Favicon (cannot be renamed!) and cursor images

	ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
	ExpiresByType image/x-icon "access plus 1 week"

	# HTML

	ExpiresByType text/html "access plus 0 seconds"


	# JavaScript

	ExpiresByType application/javascript "access plus 1 year"
	ExpiresByType application/x-javascript "access plus 1 year"
	ExpiresByType text/javascript "access plus 1 year"


	# Manifest files

	ExpiresByType application/manifest+json "access plus 1 week"
	ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
	ExpiresByType text/cache-manifest "access plus 0 seconds"


	# Media files

	ExpiresByType audio/ogg "access plus 1 month"
	ExpiresByType image/bmp "access plus 1 month"
	ExpiresByType image/gif "access plus 1 month"
	ExpiresByType image/jpeg "access plus 1 month"
	ExpiresByType image/png "access plus 1 month"
	ExpiresByType image/svg+xml "access plus 1 month"
	ExpiresByType image/webp "access plus 1 month"
	ExpiresByType video/mp4 "access plus 1 month"
	ExpiresByType video/ogg "access plus 1 month"
	ExpiresByType video/webm "access plus 1 month"


	# Web fonts

	# Embedded OpenType (EOT)
	ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
	ExpiresByType font/eot "access plus 1 month"

	# OpenType
	ExpiresByType font/opentype "access plus 1 month"

	# TrueType
	ExpiresByType application/x-font-ttf "access plus 1 month"

	# Web Open Font Format (WOFF) 1.0
	ExpiresByType application/font-woff "access plus 1 month"
	ExpiresByType application/x-font-woff "access plus 1 month"
	ExpiresByType font/woff "access plus 1 month"

	# Web Open Font Format (WOFF) 2.0
	ExpiresByType application/font-woff2 "access plus 1 month"


	# Other

	ExpiresByType text/x-cross-domain-policy "access plus 1 week"

	</IfModule>

	# Allow concatenation from within specific files.
	#
	# e.g.:
	#
	# If you have the following lines in a file called, for
	# example, `main.combined.js`:
	#
	# <!--#include file="js/jquery.js" -->
	# <!--#include file="js/jquery.timer.js" -->
	#
	# Apache will replace those lines with the content of the
	# specified files.

	# <IfModule mod_include.c>
	# <FilesMatch "\.combined\.js$">
	# Options +Includes
	# AddOutputFilterByType INCLUDES application/javascript \
	# application/x-javascript \
	# text/javascript
	# SetOutputFilter INCLUDES
	# </FilesMatch>
	# <FilesMatch "\.combined\.css$">
	# Options +Includes
	# AddOutputFilterByType INCLUDES text/css
	# SetOutputFilter INCLUDES
	# </FilesMatch>
	# </IfModule>


	# <IfModule mod_rewrite.c>
	# RewriteEngine On
	# RewriteCond %{REQUEST_FILENAME} !-f
	# RewriteRule ^(.+)\.(\d+)\.(bmp\|css\|cur\|gif\|ico\|jpe?g\|js\|png\|svgz?\|webp\|webmanifest)$ $1.$3 [L]
	# </IfModule>