-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathhtaccess.txt
More file actions
155 lines (111 loc) · 5.93 KB
/
Copy pathhtaccess.txt
File metadata and controls
155 lines (111 loc) · 5.93 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
# doi ten file nay thanh .htaccess roi su dung
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
# Redirect to new domain
#RewriteCond %{HTTP_HOST} ^old-domain\.com$ [NC]
#RewriteRule ^(.*)$ http://new-domain\.vn/%{REQUEST_URI} [R=301,L]
# HTTPS redirect
#RewriteCond %{HTTPS} off
#RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
# HTTP redirect -> no SSL
RewriteCond %{HTTPS} on
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# Using non-www (Recommendations)
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
#RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1%{REQUEST_URI} [R=301,L]
# for primary domain -> comment if using wordpress in sub-directory
RewriteBase /
# for sub directory -> remove comment if using wordpress in sub-directory
# RewriteBase /sub-dir
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# for primary domain -> comment if using wordpress in sub-directory
RewriteRule . /index.php [L]
# for sub directory -> remove comment if using wordpress in sub-directory
# RewriteRule . /sub-dir/index.php [L]
</IfModule>
# END WordPress
<ifModule mod_gzip.c>
mod_gzip_on Yes
mod_gzip_dechunk Yes
mod_gzip_item_include file \.(html?|txt|css|js|php|pl)$
mod_gzip_item_include handler ^cgi-script$
mod_gzip_item_include mime ^text/.*
mod_gzip_item_include mime ^application/x-javascript.*
mod_gzip_item_exclude mime ^image/.*
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>
<IfModule mod_deflate.c>
#The following line is enough for .js and .css
AddOutputFilter DEFLATE js css
AddOutputFilterByType DEFLATE text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/x-httpd-php application/x-httpd-fastphp text/html
#The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
</IfModule>
### marker BROWSER CACHE start ###
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType application/pdf A31557600
ExpiresByType image/x-icon A31557600
ExpiresByType image/vnd.microsoft.icon A31557600
ExpiresByType image/svg+xml A31557600
ExpiresByType image/jpg A31557600
ExpiresByType image/jpeg A31557600
ExpiresByType image/png A31557600
ExpiresByType image/gif A31557600
ExpiresByType image/webp A31557600
ExpiresByType video/ogg A31557600
ExpiresByType audio/ogg A31557600
ExpiresByType video/mp4 A31557600
ExpiresByType video/webm A31557600
ExpiresByType text/css A31557600
ExpiresByType text/javascript A31557600
ExpiresByType application/javascript A31557600
ExpiresByType application/x-javascript A31557600
ExpiresByType application/x-font-ttf A31557600
ExpiresByType application/x-font-woff A31557600
ExpiresByType application/font-woff A31557600
ExpiresByType application/font-woff2 A31557600
ExpiresByType application/vnd.ms-fontobject A31557600
ExpiresByType font/ttf A31557600
ExpiresByType font/otf A31557600
ExpiresByType font/woff A31557600
ExpiresByType font/woff2 A31557600
</IfModule>
### marker BROWSER CACHE end ###
<IfModule mod_headers.c>
<FilesMatch "\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$">
Header set Cache-Control "public, must-revalidate, proxy-revalidate"
</FilesMatch>
<FilesMatch "\.(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch "\.(css)$">
# Header set Cache-Control "public"
Header set Cache-Control "public, must-revalidate, proxy-revalidate"
</FilesMatch>
<FilesMatch "\.(js)$">
# Header set Cache-Control "private"
Header set Cache-Control "public, must-revalidate, proxy-revalidate"
</FilesMatch>
<FilesMatch "\.(x?html|htm|php|asp|aspx)$">
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
</FilesMatch>
# https://techtalk.vn/tat-ca-nhung-thu-ban-can-biet-ve-http-security-headers.html
# https://hstspreload.org/
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
# https://ssl-config.mozilla.org/
# Header always set Strict-Transport-Security "max-age=63072000; always"
#Header always set X-XSS-Protection "1; mode=block; report=https://argsec.report-uri.com/r/d/xss/enforce"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options nosniff
Header always set Referrer-Policy "strict-origin-when-cross-origin"
#Header always set Content-Security-Policy "default-src 'self' facebook.com onesignal.com; script-src 'self' 'unsafe-inline' www.googletagmanager.com connect.facebook.net www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net onesignal.com tpc.googlesyndication.com https://cdn.onesignal.com https://*.onesignal.com https://cdn4.mxpnl.com; style-src 'self' data: 'unsafe-inline' onesignal.com; img-src 'self' data: www.googletagmanager.com stats.g.doubleclick.net www.google-analytics.com www.facebook.com www.google.com www.google.com.vn googleads.g.doubleclick.net i.ytimg.com images.dmca.com; frame-src www.googletagmanager.com bid.g.doubleclick.net www.facebook.com www.google.com www.youtube.com connect.facebook.net docs.google.com https://onesignal.com tpc.googlesyndication.com; font-src 'self' data:; connect-src 'self' *.google.com google.com google.com.vn www.google-analytics.com onesignal.com stats.g.doubleclick.net www.facebook.com https://api.mixpanel.com/; report-uri https://argsec.report-uri.com/r/d/csp/reportOnly"
# Header always set Permissions-Policy 'browsing-topics=(), geolocation=*, midi=(), sync-xhr=(self "https://{my_domain.com}" "https://www.{my_domain.com}"), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=(), fullscreen=(self "https://{my_domain.com}" "https://www.{my_domain.com}")'
</IfModule>