Options -Indexes -ExecCGI -Includes -MultiViews

<IfModule !mod_authz_core.c>
	<Files *.php>
		Require all denied
	</Files>

	<Files index.php>
		Order Allow,Deny
		Allow from all
	</Files>
</IfModule>

<IfModule mod_authz_core.c>
	<FilesMatch "\.(?i:php)$">
		Require all denied
	</FilesMatch>

	<Files index.php>
		Require all granted
	</Files>
</IfModule>

<IfModule dir_module>
    DirectoryIndex index.php
</IfModule>

#pass the authorization header to php when running via php-fpm/proxy_fcgi,
#otherwise rest/api authentication won't work
<IfModule mod_setenvif.c>
	SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>

#security headers
<IfModule mod_headers.c>
	#Header always set X-Frame-Options "SAMEORIGIN"
	#Header always set X-Content-Type-Options "nosniff"
	#Header always set Referrer-Policy "strict-origin-when-cross-origin"

	#uncomment to force https requests from http pages
	#Header always set Content-Security-Policy "upgrade-insecure-requests;"

	#enable after confirming https works
	#Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine On

#for sub directory installs set the sub directory here eg "/vvveb"
RewriteBase /

# Redirect http to https
#RewriteCond %{HTTPS} !=on
#RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

#deny access to hidden files and folders except .well-known (acme challenges)
RewriteRule (^|/)\.(?!well-known) - [F,L]

#page cache, serve stored pages directly without going through php
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{QUERY_STRING} !.*=.*
RewriteCond %{HTTP_COOKIE} !^.*(nocache|cart|user|admin).*$
RewriteCond %{QUERY_STRING} !^.*(/admin).*$
RewriteCond %{DOCUMENT_ROOT}/page-cache/%{HTTP_HOST}/$1/index.html -f
RewriteRule ^(.*) /page-cache/%{HTTP_HOST}/$1/index.html [L]
RewriteCond %{DOCUMENT_ROOT}/page-cache/%{HTTP_HOST}/$1 -f
RewriteRule ^(.*) /page-cache/%{HTTP_HOST}/$1 [L]
#end page cache

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
</IfModule>

#static files expiration
#ExpiresDefault A2592000 = 1 month in the future
#Cache-Control "max-age=2592000" = 1 month

<IfModule mod_headers.c>

	Header unset ETag

	<FilesMatch "\.(txt|xml|json|js|css)$">
		Header set Cache-Control "max-age=2592000, public"
	</FilesMatch>

	<FilesMatch "\.(flv|ico|pdf|avi|mov|ppt|doc|docx|mp3|wmv|wav|mp4|m4v|ogg|webm|aac)$">
		Header set Cache-Control "max-age=31536000, public, immutable"
	</FilesMatch>

	<FilesMatch "\.(jpg|jpeg|png|gif|swf|webp|avif|svg|svgz)$">
		Header set Cache-Control "max-age=31536000, public, immutable"
	</FilesMatch>

	<FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2)$">
		Header set Cache-Control "max-age=31536000, public, immutable"
		Header set Access-Control-Allow-Origin "*"
	</FilesMatch>
</IfModule>

#FileETag None

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault A2592000

    <FilesMatch "\.(txt|xml|json|js|css)$">
    ExpiresDefault A2592000
    </FilesMatch>

    <FilesMatch "\.(ico|pdf|avi|mov|ppt|doc|docx|mp3|wmv|wav|mp4|m4v|ogg|webm|aac)$">
    ExpiresDefault A31536000
    </FilesMatch>

    <FilesMatch "\.(jpg|jpeg|png|gif|swf|webp|avif|svg|svgz)$">
    ExpiresDefault A31536000
    </FilesMatch>

    <FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2)$">
    ExpiresDefault A31536000
    </FilesMatch>
</IfModule>

#gzip to reduce response size
<IfModule mod_deflate.c>
    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE "application/atom+xml" \
                                      "application/javascript" \
                                      "application/json" \
                                      "application/ld+json" \
                                      "application/manifest+json" \
                                      "application/rdf+xml" \
                                      "application/rss+xml" \
                                      "application/schema+json" \
                                      "application/vnd.api+json" \
                                      "application/vnd.geo+json" \
                                      "application/vnd.ms-fontobject" \
                                      "application/x-font-ttf" \
                                      "application/x-javascript" \
                                      "application/x-web-app-manifest+json" \
                                      "application/xhtml+xml" \
                                      "application/xml" \
                                      "font/eot" \
                                      "font/opentype" \
                                      "image/bmp" \
                                      "image/svg+xml" \
                                      "image/vnd.microsoft.icon" \
                                      "image/x-icon" \
                                      "text/cache-manifest" \
                                      "text/css" \
                                      "text/html" \
                                      "text/javascript" \
                                      "text/plain" \
                                      "text/vcard" \
                                      "text/vnd.rim.location.xloc" \
                                      "text/vtt" \
                                      "text/x-component" \
                                      "text/x-cross-domain-policy" \
                                      "text/xml"

        #don't compress already compressed formats
        SetEnvIfNoCase Request_URI "\.(?:gif|jpe?g|png|webp|avif|gz|zip|rar|bz2|7z|xz|mp[34]|webm|og[v g]|woff2?)$" no-gzip
    </IfModule>

    <IfModule mod_mime.c>
        AddEncoding gzip              svgz
    </IfModule>

</IfModule>
