# ---------------------------------------------------------------------- # Proper MIME type for all files # ---------------------------------------------------------------------- # JAVASCRIPT # Normalize to standard type (it's sniffed in IE anyways) # tools.ietf.org/html/rfc4329#section-7.2 AddType application/javascript js jsonp AddType application/json json # Audio AddType audio/ogg oga ogg AddType audio/mp4 m4a f4a f4b # Video AddType video/ogg ogv AddType video/mp4 mp4 m4v f4v f4p AddType video/webm webm AddType video/x-flv flv # SVG # Required for svg webfonts on iPad # twitter.com/FontSquirrel/status/14855840545 AddType image/svg+xml svg svgz AddEncoding gzip svgz # Webfonts AddType application/vnd.ms-fontobject eot AddType application/x-font-ttf ttf ttc AddType font/opentype otf AddType application/x-font-woff woff # Assorted types AddType image/x-icon ico AddType image/webp webp AddType text/cache-manifest appcache manifest AddType text/x-component htc AddType application/xml rss atom xml rdf AddType application/x-chrome-extension crx AddType application/x-opera-extension oex AddType application/x-xpinstall xpi AddType application/octet-stream safariextz AddType application/x-web-app-manifest+json webapp AddType text/x-vcard vcf AddType application/x-shockwave-flash swf # ---------------------------------------------------------------------- # Gzip compression # ---------------------------------------------------------------------- # Force compression for mangled `Accept-Encoding` request headers # https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # Compress all output labeled with one of the following media types. # # (!) For Apache versions below version 2.3.7 you don't need to # enable `mod_filter` and can remove the `` # and `` lines as `AddOutputFilterByType` is still in # the core directives. # # https://httpd.apache.org/docs/current/mod/mod_filter.html#addoutputfilterbytype AddOutputFilterByType DEFLATE "application/atom+xml" \ "application/javascript" \ "application/json" \ "application/ld+json" \ "application/manifest+json" \ "application/rdf+xml" \ "application/rss+xml" \ "application/schema+json" \ "application/vnd.geo+json" \ "application/vnd.ms-fontobject" \ "application/x-font-ttf" \ "application/x-javascript" \ "application/x-web-app-manifest+json" \ "application/xhtml+xml" \ "application/xml" \ "font/eot" \ "font/opentype" \ "image/bmp" \ "image/svg+xml" \ "image/vnd.microsoft.icon" \ "image/x-icon" \ "text/cache-manifest" \ "text/css" \ "text/html" \ "text/javascript" \ "text/plain" \ "text/vcard" \ "text/vnd.rim.location.xloc" \ "text/vtt" \ "text/x-component" \ "text/x-cross-domain-policy" \ "text/xml" # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # Map the following filename extensions to the specified # encoding type in order to make Apache serve the file types # with the appropriate `Content-Encoding` response header # (do note that this will NOT make Apache compress them!). # # If these files types would be served without an appropriate # `Content-Enable` response header, client applications (e.g.: # browsers) wouldn't know that they first need to uncompress # the response, and thus, wouldn't be able to understand the # content. # # https://httpd.apache.org/docs/current/mod/mod_mime.html#addencoding AddEncoding gzip svgz # ---------------------------------------------------------------------- # Expires headers (for better cache control) # ---------------------------------------------------------------------- # These are pretty far-future expires headers. # They assume you control versioning with filename-based cache busting # Additionally, consider that outdated proxies may miscache # www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ # If you don't use filenames to version, lower the CSS and JS to something like # "access plus 1 week" or so. ExpiresActive on # Perhaps better to whitelist expires rules? Perhaps. ExpiresDefault "access plus 1 month" # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) ExpiresByType text/cache-manifest "access plus 0 seconds" # Your document html ExpiresByType text/html "access plus 0 seconds" # Data ExpiresByType text/xml "access plus 0 seconds" ExpiresByType application/xml "access plus 0 seconds" ExpiresByType application/json "access plus 0 seconds" # Feed ExpiresByType application/rss+xml "access plus 1 hour" ExpiresByType application/atom+xml "access plus 1 hour" # Favicon (cannot be renamed) ExpiresByType image/x-icon "access plus 1 week" # Media: images, video, audio ExpiresByType image/gif "access plus 1 month" ExpiresByType image/png "access plus 1 month" ExpiresByType image/jpeg "access plus 1 month" ExpiresByType video/ogg "access plus 1 month" ExpiresByType audio/ogg "access plus 1 month" ExpiresByType video/mp4 "access plus 1 month" ExpiresByType video/webm "access plus 1 month" # HTC files (css3pie) ExpiresByType text/x-component "access plus 1 month" # Webfonts ExpiresByType application/x-font-ttf "access plus 1 month" ExpiresByType font/opentype "access plus 1 month" ExpiresByType application/x-font-woff "access plus 1 month" ExpiresByType image/svg+xml "access plus 1 month" ExpiresByType application/vnd.ms-fontobject "access plus 1 month" # CSS and JavaScript ExpiresByType text/css "access plus 1 year" ExpiresByType application/javascript "access plus 1 year" # ---------------------------------------------------------------------- # ETag removal # ---------------------------------------------------------------------- # FileETag None is not enough for every server. Header unset ETag # Since we're sending far-future expires, we don't need ETags for # static content. developer.yahoo.com/performance/rules.html#etags FileETag None # ---------------------------------------------------------------------- # Start rewrite engine # ---------------------------------------------------------------------- # Turning on the rewrite engine is necessary for the following rules and features. # FollowSymLinks must be enabled for this to work. # # Some cloud hosting services require RewriteBase to be set: goo.gl/HOcPN # If using the h5bp in a subdirectory, use `RewriteBase /foo` instead where 'foo' is your directory. Options +FollowSymlinks RewriteEngine On RewriteBase / # ---------------------------------------------------------------------- # Remove "www." from beginning of URLs # http://stackoverflow.com/questions/234723/generic-htaccess-redirect-www-to-non-www # ---------------------------------------------------------------------- RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC] RewriteRule ^(.*)$ http://%1/$1 [R=301,L] # ---------------------------------------------------------------------- # Force "/" at the end of URLs # No duplicated content with this way # ---------------------------------------------------------------------- RewriteCond %{REQUEST_METHOD} !=POST RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.+[^/])$ /$1/ [R=301,L] # ---------------------------------------------------------------------- # Prevent 404 errors for non-existing redirected folders # ---------------------------------------------------------------------- # without -MultiViews, Apache will give a 404 for a rewrite if a folder of the same name does not exist # e.g. /blog/hello : webmasterworld.com/apache/3808792.htm Options -MultiViews # ---------------------------------------------------------------------- # UTF-8 encoding # ---------------------------------------------------------------------- # Use UTF-8 encoding for anything served text/plain or text/html AddDefaultCharset utf-8 # Force UTF-8 for a number of file formats AddCharset utf-8 .css .js .xml .json .rss .atom # ---------------------------------------------------------------------- # A little more security # ---------------------------------------------------------------------- # Do we want to advertise the exact version number of Apache we're running? # Probably not. # This can only be enabled if used in httpd.conf - It will not work in .htaccess # ServerTokens Prod # "-Indexes" will have Apache block users from browsing folders without a default document # Usually you should leave this activated, because you shouldn't allow everybody to surf through # every folder on your server (which includes rather private places like CMS system folders). Options -Indexes # Block access to "hidden" directories or files whose names begin with a period. This # includes directories used by version control systems such as Subversion or Git. RewriteCond %{SCRIPT_FILENAME} -d [OR] RewriteCond %{SCRIPT_FILENAME} -f RewriteRule "(^|/)\." - [F] # Block access to backup and source files # These files may be left by some text/html editors and # pose a great security danger, when anyone can access them Order allow,deny Deny from all Satisfy All # Increase cookie security php_value session.cookie_httponly true # Hide .git and _svn folders so they cannot be accessed # But you shouldn't upload them in the first place RewriteRule ^(.*/)*_svn/ / [F,L] RewriteRule ^(.*/)*\.git/ / [F,L] # ---------------------------------------------------------------------- # Default CraftCMS Rewrite # ---------------------------------------------------------------------- RewriteEngine On # Send would-be 404 requests to Craft RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC] RewriteRule (.+) index.php?p=$1 [QSA,L]