|
# ################################## |
|
# SECURITY |
|
# ################################## |
|
|
|
# Disable the server signature |
|
ServerSignature Off |
|
|
|
# Add default charset |
|
AddDefaultCharset UTF-8 |
|
|
|
# Disable directory browsing |
|
Options All -Indexes |
|
|
|
# Redirect all trafic to https |
|
<IfModule mod_rewrite.c> |
|
RewriteEngine On |
|
|
|
# Redirect http to https |
|
# RewriteEngine On |
|
# RewriteCond %{HTTPS} !=on |
|
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] |
|
|
|
# Redirect www to non-www and http to https |
|
RewriteCond %{HTTPS} off [OR] |
|
RewriteCond %{HTTP_HOST} ^www\. [NC] |
|
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC] |
|
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301] |
|
|
|
# Redirect non-www to www and http to https |
|
# RewriteCond %{HTTP_HOST} !^www\. [NC,OR] |
|
# RewriteCond %{HTTPS} off |
|
# RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC] |
|
# RewriteRule ^ https://www.%1%{REQUEST_URI} [R=301,L,NE] |
|
</IfModule> |
|
|
|
# Protect System Files, Disable PHP in Uploads, Filter Request Methods, by iThemes Security |
|
<IfModule mod_rewrite.c> |
|
RewriteEngine On |
|
|
|
# Protect System Files |
|
RewriteRule ^wp-admin/install\.php$ - [F] |
|
RewriteRule ^wp-admin/includes/ - [F] |
|
RewriteRule !^wp-includes/ - [S=3] |
|
RewriteRule ^wp-includes/[^/]+\.php$ - [F] |
|
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F] |
|
RewriteRule ^wp-includes/theme-compat/ - [F] |
|
RewriteCond %{REQUEST_FILENAME} -f |
|
RewriteRule (^|.*/)\.(git|svn)/.* - [F] |
|
|
|
# Disable PHP in Uploads |
|
RewriteRule ^wp\-content/uploads/.*\.(?:php[1-7]?|pht|phtml?|phps)\.?$ - [NC,F] |
|
|
|
# Filter Request Methods |
|
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC] |
|
RewriteRule ^.* - [F] |
|
</IfModule> |
|
|
|
# Secure Important Files |
|
<FilesMatch "^.*(error_log|wp-config\.php|\.ini|\.[hH][tT][aApP].*)$"> |
|
Order deny,allow |
|
Deny from all |
|
</FilesMatch> |
|
|
|
## Prevent access to specific types of files |
|
#<FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$"> |
|
# Order Allow,Deny |
|
# Deny from all |
|
#</FilesMatch> |
|
|
|
# Protect System Files |
|
<files .htaccess> |
|
Order allow,deny |
|
Deny from all |
|
</files> |
|
<files readme.html> |
|
Order allow,deny |
|
Deny from all |
|
</files> |
|
<files readme.txt> |
|
Order allow,deny |
|
Deny from all |
|
</files> |
|
<files wp-config.php> |
|
Order allow,deny |
|
Deny from all |
|
</files> |
|
|
|
# Block WordPress xmlrpc.php requests |
|
<Files xmlrpc.php> |
|
order deny,allow |
|
deny from all |
|
</Files> |
|
|
|
# Security Headers |
|
# May cause errors, usually when loading external scripts, iframes etc.. |
|
<IfModule mod_headers.c> |
|
# Use HTTP Strict Transport Security to force client to use secure connections only. |
|
# max-age=15768000 is 6 Months |
|
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" |
|
|
|
# Enforce enable the cross-site scripting (XSS) filter built into modern web browsers. |
|
Header set X-XSS-Protection "1; mode=block" |
|
|
|
# Provide clickjacking protection by not allowing iframes to load our website. |
|
header always set x-frame-options "SAMEORIGIN" |
|
|
|
# Prevent IE and Chrome from sniffing a response away from the declared content-type. This helps reduce the danger of drive-by downloads and helps treat the content the right way. |
|
Header always set x-content-type-options "nosniff" |
|
|
|
# Activate CORS |
|
<FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2|font.css|css|js|gif|png|jpe?g|svg|svgz|ico|webp)$"> |
|
Header set Access-Control-Allow-Origin "*" |
|
</FilesMatch> |
|
|
|
# Set Content security policy as to: |
|
# default-src - Is the default policy for loading content such as JS, Images, CSS, Fonts etc.. |
|
# https: - Allows loading resources only over HTTPS on any domain. |
|
# data: - Allows loading resources via the data scheme (eg Base64 encoded images). |
|
# 'unsafe-inline' - allow inline css,js |
|
# 'unsafe-eval' - Allows unsafe dynamic code evaluation such as JavaScript eval() |
|
# More info: https://content-security-policy.com/ |
|
Header always set Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'" |
|
|
|
# Set the Referrer-Policy |
|
# no-referrer-when-downgrade - The origin, path, and querystring of the URL are sent as a referrer when |
|
# the protocol security level stays the same or improves, |
|
# but isn't sent to less secure destinations. |
|
Header set Referrer-Policy "no-referrer-when-downgrade" |
|
|
|
# Set the Feature-policy |
|
Header set Feature-Policy "vibrate 'self'; push *; camera 'none'; microphone 'none'" |
|
</IfModule> |
|
|
|
# ################################## |
|
# PERFORMANCE |
|
# ################################## |
|
|
|
# cds - BEGIN DEFLATE COMPRESSION |
|
<IfModule mod_deflate.c> |
|
# Compress HTML, CSS, JavaScript, Text, XML and fonts |
|
<IfModule mod_filter.c> |
|
FilterDeclare COMPRESS |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $text/css |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $text/javascript |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $text/plain |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $text/xml |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/javascript |
|
|
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/json |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-javascript |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/atom+xml |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/rss+xml |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/xhtml+xml |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/xml |
|
|
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/vnd.ms-fontobject |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-ttf |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-opentype |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-otf |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-truetype |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $font/opentype |
|
|
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $image/svg+xml |
|
FilterProvider COMPRESS DEFLATE resp=Content-Type $image/x-icon |
|
|
|
FilterChain COMPRESS |
|
FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no |
|
</IfModule> |
|
<IfModule !mod_filter.c> |
|
# Compress HTML, CSS, JavaScript, Text, XML and fonts |
|
AddOutputFilterByType DEFLATE application/javascript |
|
AddOutputFilterByType DEFLATE application/rss+xml |
|
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject |
|
AddOutputFilterByType DEFLATE application/x-font |
|
AddOutputFilterByType DEFLATE application/x-font-opentype |
|
AddOutputFilterByType DEFLATE application/x-font-otf |
|
AddOutputFilterByType DEFLATE application/x-font-truetype |
|
AddOutputFilterByType DEFLATE application/x-font-ttf |
|
AddOutputFilterByType DEFLATE application/x-javascript |
|
AddOutputFilterByType DEFLATE application/xhtml+xml |
|
AddOutputFilterByType DEFLATE application/xml |
|
AddOutputFilterByType DEFLATE font/opentype |
|
AddOutputFilterByType DEFLATE font/otf |
|
AddOutputFilterByType DEFLATE font/ttf |
|
AddOutputFilterByType DEFLATE image/svg+xml |
|
AddOutputFilterByType DEFLATE image/x-icon |
|
AddOutputFilterByType DEFLATE text/css |
|
AddOutputFilterByType DEFLATE text/html |
|
AddOutputFilterByType DEFLATE text/javascript |
|
AddOutputFilterByType DEFLATE text/plain |
|
AddOutputFilterByType DEFLATE text/xml |
|
</IfModule> |
|
# Remove browser bugs (only needed for really old browsers) |
|
<IfModule mod_setenvif.c> |
|
BrowserMatch ^Mozilla/4 gzip-only-text/html |
|
BrowserMatch ^Mozilla/4\.0[678] no-gzip |
|
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html |
|
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary |
|
</IfModule> |
|
<IfModule mod_headers.c> |
|
Header append Vary User-Agent env=!dont-vary |
|
Header append Vary Accept-Encoding |
|
</IfModule> |
|
</IfModule> |
|
# cds - END DEFLATE COMPRESSION |
|
|
|
# cds - START EXPIRES CACHING - Optimizing cache-control # |
|
<IfModule mod_expires.c> |
|
ExpiresActive On |
|
ExpiresDefault "access plus 1 month" |
|
ExpiresByType text/html "access plus 1 seconds" |
|
ExpiresByType text/xml "access plus 1 seconds" |
|
ExpiresByType text/plain "access plus 1 seconds" |
|
ExpiresByType application/xml "access plus 1 seconds" |
|
ExpiresByType application/rss+xml "access plus 1 seconds" |
|
ExpiresByType application/json "access plus 1 seconds" |
|
ExpiresByType text/css "access plus 1 month" |
|
ExpiresByType text/javascript "access plus 1 month" |
|
ExpiresByType application/javascript "access plus 1 month" |
|
ExpiresByType application/x-javascript "access plus 1 month" |
|
ExpiresByType image/x-ico "access plus 1 year" |
|
ExpiresByType image/x-icon "access plus 1 year" |
|
ExpiresByType image/gif "access plus 1 year" |
|
ExpiresByType image/png "access plus 1 year" |
|
ExpiresByType image/jpe "access plus 1 year" |
|
ExpiresByType image/jpg "access plus 1 year" |
|
ExpiresByType image/jpeg "access plus 1 year" |
|
ExpiresByType video/ogg "access plus 1 month" |
|
ExpiresByType audio/ogg "access plus 1 month" |
|
ExpiresByType video/mp4 "access plus 1 month" |
|
ExpiresByType video/webm "access plus 1 month" |
|
ExpiresByType font/truetype "access plus 1 month" |
|
ExpiresByType font/opentype "access plus 1 month" |
|
ExpiresByType application/x-font-woff "access plus 1 month" |
|
ExpiresByType image/svg+xml "access plus 1 year" |
|
ExpiresByType application/pdf "access plus 1 month" |
|
ExpiresByType application/vnd.ms-fontobject "access plus 1 month" |
|
<IfModule mod_mime.c> |
|
AddType image/vnd.microsoft.icon .ico |
|
ExpiresByType image/vnd.microsoft.icon "access plus 1 year" |
|
</IfModule> |
|
<IfModule mod_headers.c> |
|
# Turn ETags Off |
|
Header unset ETag |
|
Header unset Pragma |
|
Header unset Last-Modified |
|
Header set Connection keep-alive |
|
Header append Cache-Control "public, no-transform, must-revalidate" |
|
</IfModule> |
|
</IfModule> |
|
# cds - END EXPIRES CACHING - Optimizing cache-control # |
|
|
|
## cds - BEGIN Cache-Control Headers |
|
#<ifModule mod_headers.c> |
|
#<filesMatch "\.(ico|jpeg|jpg|png|gif|swf|pdf|svg)$"> |
|
#Header set Cache-Control "public" |
|
#</filesMatch> |
|
#<filesMatch "\.(css)$"> |
|
#Header set Cache-Control "public" |
|
#</filesMatch> |
|
#<filesMatch "\.(js)$"> |
|
#Header set Cache-Control "private" |
|
#</filesMatch> |
|
#<filesMatch "\.(x?html?|php)$"> |
|
#Header set Cache-Control "private, must-revalidate" |
|
#</filesMatch> |
|
#</ifModule> |
|
## cds - END Cache-Control Headers |
|
|
|
# Now that we're sending far-future expires headers (previous step), |
|
# we can disable all ETags that otherwise would have been sent by the server |
|
# From: https://htaccessbook.com/disable-etags/ |
|
FileETag none |
|
|
|
# BEGIN WordPress |
|
RewriteEngine On |
|
RewriteBase / |
|
RewriteRule ^index\.php$ - [L] |
|
RewriteCond %{REQUEST_FILENAME} !-f |
|
RewriteCond %{REQUEST_FILENAME} !-d |
|
RewriteRule . /index.php [L] |
|
# END WordPress |