Options -Indexes
DirectoryIndex index.html

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Block hidden/sensitive files except .well-known
RewriteRule (^|/)\.(?!well-known/) - [F,L]
RewriteRule (?i)(^|/)(?:composer\.(?:json|lock)|package(?:-lock)?\.json|yarn\.lock|\.env|\.git|backup|database|dump)(?:$|/) - [F,L]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set X-Permitted-Cross-Domain-Policies "none"
Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'none'; form-action 'none'; img-src 'self' data:; style-src 'self'; script-src 'self'; font-src 'self'; media-src 'self'; connect-src 'self'; upgrade-insecure-requests"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

<IfModule mod_mime.c>
AddType application/pdf .pdf
</IfModule>

# Static link page: reject methods it never needs.
<LimitExcept GET HEAD OPTIONS>
  Require all denied
</LimitExcept>

# Prevent script execution if executable files are ever uploaded into this folder.
<FilesMatch "\.(?:php[0-9]?|phtml|phar|cgi|pl|py|rb|sh|shtml)$">
  Require all denied
</FilesMatch>

<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/png "access plus 30 days"
ExpiresByType text/css "access plus 7 days"
ExpiresByType application/javascript "access plus 7 days"
ExpiresByType application/pdf "access plus 1 day"
</IfModule>
