phpMyCellar/.htaccess.example at main · dmueller-dev/phpMyCellar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# ==============================================================================
# phpMyCellar - Sample Apache Web Server Configuration (.htaccess)
# ==============================================================================
# Copy this file to '.htaccess' in the root directory of your installation.
# ==============================================================================

# Disable directory browsing
Options -Indexes -MultiViews

# Default character encoding
AddDefaultCharset UTF-8

# Enable URL rewriting if mod_rewrite is available
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent direct access to hidden files and directories (e.g. .git, .env)
    RewriteRule (^\.|/\.) - [F]

    # Block direct web access to sensitive directories
    RewriteRule ^includes/ - [F,L]
    RewriteRule ^install/installed\.lock$ - [F,L]
    RewriteRule ^install/(schema|seed)\.sql$ - [F,L]

    # Legacy URL redirects (deprecated since v1.0.0, stubs scheduled for removal in v2.0.0)
    RewriteRule ^tnote\.php$ /tnotes.php [R=301,L,QSA]
    RewriteRule ^wine\.php$ /wines.php [R=301,L,QSA]
    RewriteRule ^blogpost\.php$ /blog.php [R=301,L,QSA]
</IfModule>

# Block direct access to configuration files, dotfiles, and private files
<FilesMatch "(^\.env|\.sql|\.md|\.lock|\.json|\.log|Dockerfile|docker-compose\.yml|LICENSE)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Security HTTP Headers
<IfModule mod_headers.c>
    # Prevent MIME type sniffing
    Header always set X-Content-Type-Options "nosniff"

    # Clickjacking protection
    Header always set X-Frame-Options "SAMEORIGIN"

    # Control Referrer information
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # XSS Protection filter for older browsers
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>

# Caching for static assets in uploads/img
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
</IfModule>