# Security Headers
<IfModule mod_headers.c>
  Header set X-XSS-Protection "1; mode=block"
  Header set X-Frame-Options "sameorigin"
  Header set X-Content-Type-Options "nosniff"
  Header set X-Permitted-Cross-Domain-Policies "none"
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

  Header set Content-Security-Policy "default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'"
  Header set Feature-Policy "camera 'none'; fullscreen 'self'; geolocation *; microphone 'self'"
  Header set Referrer-Policy "no-referrer-when-downgrade"

  Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
  Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
  Header set Pragma "no-cache"
</IfModule>

# gZip enabled
<ifModule mod_gzip.c>
  mod_gzip_on Yes
  mod_gzip_dechunk Yes
  mod_gzip_item_include file \.(html?|txt|css|js|php|pl)$
  mod_gzip_item_include mime ^application/x-javascript.*
  mod_gzip_item_include mime ^text/.*
  mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
  mod_gzip_item_exclude mime ^image/.*
  mod_gzip_item_include handler ^cgi-script$
</ifModule>

# Expires
<IfModule mod_expires.c>
  ExpiresActive on
  ExpiresByType text/cache-manifest       "access plus 0 seconds"
  ExpiresByType text/html                 "access plus 0 seconds"
  ExpiresByType text/xml                  "access plus 0 seconds"
  ExpiresByType application/xml           "access plus 0 seconds"
  ExpiresByType application/json          "access plus 0 seconds"
  ExpiresByType application/rss+xml       "access plus 1 hour"
  ExpiresByType image/x-icon              "access plus 1 week"
  ExpiresDefault                          "access plus 3 months"
  ExpiresByType image/gif                 "access plus 3 months"
  ExpiresByType image/png                 "access plus 3 months"
  ExpiresByType image/jpg                 "access plus 3 months"
  ExpiresByType image/jpeg                "access plus 3 months"
  ExpiresByType video/ogg                 "access plus 3 months"
  ExpiresByType audio/ogg                 "access plus 3 months"
  ExpiresByType video/mp4                 "access plus 3 months"
  ExpiresByType video/webm                "access plus 3 months"
  ExpiresByType text/x-component          "access plus 3 months"
  ExpiresByType font/truetype             "access plus 3 months"
  ExpiresByType font/opentype             "access plus 3 months"
  ExpiresByType application/x-font-woff   "access plus 3 months"
  ExpiresByType image/svg+xml             "access plus 3 months"
  ExpiresByType application/vnd.ms-fontobject "access plus 3 months"
  ExpiresByType text/css                  "access plus 2 months"
  ExpiresByType application/javascript    "access plus 2 months"
  ExpiresByType text/javascript           "access plus 2 months"
</IfModule>

# Redirect to secure
#RewriteCond %{HTTPS} off
#RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Block access to .htaccess file
<Files .htaccess>
  order allow,deny
  deny from all
</Files>

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /example/index.php [L]
</IfModule>