RewriteEngine On

Options -Indexes

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

<FilesMatch "(^\.|\.env|\.ini|\.log|\.txt|\.sh|\.bak|\.sql|\.sqlite|\.sqlite3|composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|\.zip|\.rar|\.7z|\.tar|\.gz)$">
    Require all denied
</FilesMatch>

RewriteRule ^(config|includes|storage|vendor|database|logs|backups|core|controllers)/ - [F,L,NC]

RewriteCond %{HTTP_REFERER} !^$

RewriteRule \.(jpg|jpeg|png|webp|gif|mp4|m3u8|ts)$ - [F,NC,L]

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json text/javascript text/plain application/xml text/xml image/svg+xml
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType text/javascript "access plus 7 days"
    ExpiresByType application/json "access plus 1 day"
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType image/jpeg "access plus 30 days"
    ExpiresByType image/jpg "access plus 30 days"
    ExpiresByType image/webp "access plus 30 days"
    ExpiresByType image/gif "access plus 30 days"
    ExpiresByType image/svg+xml "access plus 30 days"
    ExpiresByType font/woff "access plus 30 days"
    ExpiresByType font/woff2 "access plus 30 days"
</IfModule>

<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self'; upgrade-insecure-requests"
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php81” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
