# WORKBENCH: safe server settings for Apache hosts (this includes cPanel hosting).
# Every block is wrapped in <IfModule>, so if your host lacks a feature the site still works.

ErrorDocument 404 /404.html

# --- HTTPS: remove the "#" from these three lines AFTER your SSL certificate is installed ---
# RewriteEngine On
# RewriteCond %{HTTPS} off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Never let anyone download hidden files such as .htaccess or .env. (The .well-known folder that SSL setup needs is not affected.)
<FilesMatch "^\.">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
  # Fonts almost never change, so browsers may keep them for a year.
  <FilesMatch "\.woff2$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  # Style, script and image files are kept for a week. When you edit style.css or main.js, change the number
  # after "?v=" in index.html (for example ?v=2) and visitors get the new file straight away.
  <FilesMatch "\.(css|js|svg|png|jpg|jpeg|webp)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>

  # OPTIONAL, extra strict: blocks any script, style or font that is not from your own site. Switch it on by removing
  # the "#" below. It will also block things you add later (a map, a review widget, analytics) until you allow them.
  # Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; form-action 'self'; base-uri 'self'; frame-ancestors 'self'"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript image/svg+xml application/json
</IfModule>
