90 lines
2.9 KiB
ApacheConf
90 lines
2.9 KiB
ApacheConf
# MSPE Public Folder .htaccess
|
|
|
|
RewriteEngine On
|
|
RewriteBase /
|
|
|
|
# Disable directory listing
|
|
Options -Indexes
|
|
|
|
# Force HTTPS
|
|
RewriteCond %{HTTPS} off
|
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
|
|
|
|
# Canonical: redirect www to non-www
|
|
RewriteCond %{HTTP_HOST} ^www\.mspe\.pro [NC]
|
|
RewriteRule ^(.*)$ https://mspe.pro/$1 [L,R=301]
|
|
|
|
# Handle SPA-style routing if needed - redirect 404s to index
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteCond %{REQUEST_URI} !^/api/
|
|
RewriteCond %{REQUEST_URI} !^/admin/
|
|
RewriteRule ^.*$ 404.html [L]
|
|
|
|
# Block dev/test/seed scripts in production
|
|
<FilesMatch "^(db_seed|db_test|email-test)\.php$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order deny,allow
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# Protect .env files
|
|
<FilesMatch "^\.env">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order deny,allow
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# Prevent access to hidden files
|
|
<FilesMatch "^\.">
|
|
Order allow,deny
|
|
Deny from all
|
|
</FilesMatch>
|
|
|
|
# Prevent access to JSON data files from web
|
|
<FilesMatch "\.(json)$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order deny,allow
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# Security headers
|
|
<IfModule mod_headers.c>
|
|
Header set X-Content-Type-Options "nosniff"
|
|
Header set X-Frame-Options "SAMEORIGIN"
|
|
Header set X-XSS-Protection "0"
|
|
Header set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
|
|
</IfModule>
|
|
|
|
# Enable compression
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
|
|
</IfModule>
|
|
|
|
# Browser caching
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresByType image/jpg "access plus 1 month"
|
|
ExpiresByType image/jpeg "access plus 1 month"
|
|
ExpiresByType image/png "access plus 1 month"
|
|
ExpiresByType image/gif "access plus 1 month"
|
|
ExpiresByType image/webp "access plus 1 month"
|
|
ExpiresByType text/css "access plus 1 week"
|
|
ExpiresByType application/javascript "access plus 1 week"
|
|
</IfModule>
|