Options -MultiViews -Indexes RewriteEngine On # Handle Authorization Header RewriteCond %{HTTP:Authorization} . RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Handle X-XSRF-Token Header RewriteCond %{HTTP:x-xsrf-token} . RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}] # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [L,R=301] # Send Requests To Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] # Custom directives # Activer la réécriture # Bloquer l'accès aux fichiers sensibles Order allow,deny Deny from all # Bloquer l'accès aux dossiers sensibles RedirectMatch 404 ^/(vendor|storage|bootstrap|config|resources|.git)/.* # Empêcher l’affichage de répertoires Options -Indexes # Use UTF-8 encoding for anything served text/plain or text/html AddDefaultCharset UTF-8 # Force UTF-8 for a number of file formats AddCharset UTF-8 .atom .css .js .json .rss .vtt .xml # Since we’re sending far-future expires, we don’t need ETags for static content. # developer.yahoo.com/performance/rules.html#etags FileETag None # Sécurité : pas d’exécution PHP dans certains dossiers # # php_flag engine off # # # php_flag engine off # # # php_flag engine off # # # php_flag engine off # Header unset Pragma Header append Cache-Control "public" Header unset Last-Modified Header unset Pragma Header append Cache-Control "public" # Header append Cache-Control "public, max-age=31536000, immutable" # Header append Cache-Control "public, must-revalidate, max-age=2592000" AddType image/avif avif AddType image/avif-sequence avifs # En-têtes # Empêcher l’indexation par les moteurs de recherche Header set X-Robots-Tag "noindex, nofollow" # Protection XSS Header set X-XSS-Protection "1; mode=block" # Interdire l’iframe (Clickjacking) Header always append X-Frame-Options SAMEORIGIN # Bloquer le sniffing MIME Header set X-Content-Type-Options nosniff # Forcer HTTPS (si vous utilisez SSL) Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # Header set Permissions-Policy "geolocation=(), microphone=(), camera=()" # Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none';" # Header set Referrer-Policy "same-origin" # Header unset X-Forwarded-For # Header unset X-Server-IP # FileETag None is not enough for every server. Header unset ETag # Allowed methods and headers Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" Header set Access-Control-Allow-Headers "Authorization, Content-Type, Accept, Accept-Language" # Gzip compression # Active compression SetOutputFilter DEFLATE # Force deflate for mangled headers SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding # Don’t compress images and other uncompressible content SetEnvIfNoCase Request_URI \ \.(?:gif|jpe?g|png|rar|zip|exe|flv|mov|wma|mp3|avi|swf|mp?g|mp4|webm|webp|pdf)$ no-gzip dont-vary # Compress all output labeled with one of the following MIME-types AddOutputFilterByType DEFLATE application/atom+xml \ application/javascript \ application/json \ application/rss+xml \ application/vnd.ms-fontobject \ application/x-font-ttf \ application/xhtml+xml \ application/xml \ font/opentype \ image/svg+xml \ image/x-icon \ text/css \ text/html \ text/plain \ text/x-component \ text/xml Header append Vary: Accept-Encoding BrotliCompressionQuality 5 AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json application/xml image/svg+xml ExpiresActive on ExpiresDefault "access plus 1 month" # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) ExpiresByType text/cache-manifest "access plus 0 seconds" # Your document html ExpiresByType text/html "access plus 0 seconds" # Data ExpiresByType text/xml "access plus 0 seconds" ExpiresByType application/xml "access plus 0 seconds" ExpiresByType application/json "access plus 0 seconds" # Feed ExpiresByType application/rss+xml "access plus 1 hour" ExpiresByType application/atom+xml "access plus 1 hour" # Favicon (cannot be renamed) ExpiresByType image/x-icon "access plus 1 week" # Media: images, video, audio ExpiresByType image/gif "access plus 4 months" ExpiresByType image/png "access plus 4 months" ExpiresByType image/jpeg "access plus 4 months" ExpiresByType image/webp "access plus 4 months" ExpiresByType video/ogg "access plus 4 months" ExpiresByType audio/ogg "access plus 4 months" ExpiresByType video/mp4 "access plus 4 months" ExpiresByType video/webm "access plus 4 months" ExpiresByType image/avif "access plus 4 months" ExpiresByType image/avif-sequence "access plus 4 months" # HTC files (css3pie) ExpiresByType text/x-component "access plus 1 month" # Webfonts ExpiresByType font/ttf "access plus 4 months" ExpiresByType font/otf "access plus 4 months" ExpiresByType font/woff "access plus 4 months" ExpiresByType font/woff2 "access plus 4 months" ExpiresByType image/svg+xml "access plus 4 months" ExpiresByType application/vnd.ms-fontobject "access plus 1 month" # CSS and JavaScript ExpiresByType text/css "access plus 1 year" ExpiresByType application/javascript "access plus 1 year"