# --- Better website experience for IE users ---

<IfModule mod_headers.c>
 Header set X-UA-Compatible "IE=Edge"
 # mod_headers can"t match by content-type, but we don"t want to send this header on *everything*...
 <FilesMatch "\.(js|css|gif|png|jpe?g|pdf|xml|oga|ogg|m4a|ogv|mp4|m4v|webm|svg|svgz|eot|ttf|otf|woff|ico|webp|appcache|manifest|htc|crx|xpi|safariextz|vcf)$" >
 Header unset X-UA-Compatible
 </FilesMatch>
</IfModule>


# --- Webfont access ---

<FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css)$">
 <IfModule mod_headers.c>
 Header set Access-Control-Allow-Origin "*"
 </IfModule>
</FilesMatch>


# --- Proper MIME type for all files ---

# JavaScript
# Normalize to standard type (it"s sniffed in IE anyways) 
# tools.ietf.org/html/rfc4329#section-7.2
AddType application/javascript js

# Audio
AddType audio/ogg oga ogg
AddType audio/mp4 m4a

# Video
AddType video/ogg ogv
AddType video/mp4 mp4 m4v
AddType video/webm webm

# SVG.
# Required for svg webfonts on iPad
# twitter.com/FontSquirrel/status/14855840545
AddType image/svg+xml svg svgz 
AddEncoding gzip svgz
 
# Webfonts 
AddType application/vnd.ms-fontobject eot
AddType application/x-font-ttf ttf ttc
AddType font/opentype otf
AddType application/x-font-woff woff

# Assorted types 
AddType image/x-icon ico
AddType image/webp webp
AddType text/cache-manifest appcache manifest
AddType text/x-component htc
AddType application/x-chrome-extension crx
AddType application/x-xpinstall xpi
AddType application/octet-stream safariextz
AddType text/x-vcard vcf



# --- Gzip compression ---

<IfModule mod_deflate.c>

# Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/
<IfModule mod_setenvif.c>
 <IfModule mod_headers.c>
 SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
 RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
 </IfModule>
</IfModule>

# HTML, TXT, CSS, JavaScript, JSON, XML, HTC:
#<IfModule mod_filter.c>
 AddOutputFilterByType DEFLATE "application/atom+xml"  "application/javascript"  "application/json"  "application/ld+json"  "application/manifest+json"  "application/rdf+xml"  "application/rss+xml"  "application/schema+json"  "application/vnd.geo+json"  "application/vnd.ms-fontobject"  "application/x-font-ttf"  "application/x-javascript"  "application/x-web-app-manifest+json"  "application/xhtml+xml"  "application/xml"  "font/eot"  "font/opentype"  "image/bmp"  "image/svg+xml"  "image/vnd.microsoft.icon"  "image/x-icon"  "text/cache-manifest"  "text/css"  "text/html"  "text/javascript"  "text/plain"  "text/vcard"  "text/vnd.rim.location.xloc"  "text/vtt"  "text/x-component"  "text/x-cross-domain-policy"  "text/xml"

#</IfModule>




# --- Expires headers (for better cache control) ---

#<IfModule mod_expires.c>
 ExpiresActive on
 ExpiresDefault "access plus 1 month"

 # CSS
 ExpiresByType text/css "access plus 1 year"

 # Data interchange
 ExpiresByType application/atom+xml "access plus 1 hour"
 ExpiresByType application/rdf+xml "access plus 1 hour"
 ExpiresByType application/rss+xml "access plus 1 hour"

 ExpiresByType application/json "access plus 0 seconds"
 ExpiresByType application/ld+json "access plus 0 seconds"
 ExpiresByType application/schema+json "access plus 0 seconds"
 ExpiresByType application/vnd.geo+json "access plus 0 seconds"
 ExpiresByType application/xml "access plus 0 seconds"
 ExpiresByType text/xml "access plus 0 seconds"

 # Favicon (cannot be renamed!) and cursor images
 ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
 ExpiresByType image/x-icon "access plus 1 week"

 # HTML
 ExpiresByType text/html "access plus 0 seconds"

 # JavaScript
 ExpiresByType application/javascript "access plus 1 year"
 ExpiresByType application/x-javascript "access plus 1 year"
 ExpiresByType text/javascript "access plus 1 year"

 # Manifest files
 ExpiresByType application/manifest+json "access plus 1 week"
 ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
 ExpiresByType text/cache-manifest "access plus 0 seconds"

 # Media files
 ExpiresByType audio/ogg "access plus 1 month"
 ExpiresByType image/bmp "access plus 1 month"
 ExpiresByType image/gif "access plus 1 month"
 ExpiresByType image/jpeg "access plus 1 month"
 ExpiresByType image/png "access plus 1 month"
 ExpiresByType image/svg+xml "access plus 1 month"
 ExpiresByType image/webp "access plus 1 month"
 ExpiresByType video/mp4 "access plus 1 month"
 ExpiresByType video/ogg "access plus 1 month"
 ExpiresByType video/webm "access plus 1 month"

 # Web fonts
 # Embedded OpenType (EOT)
 ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
 ExpiresByType font/eot "access plus 1 month"

 # OpenType
 ExpiresByType font/opentype "access plus 1 month"

 # TrueType
 ExpiresByType application/x-font-ttf "access plus 1 month"

 # Web Open Font Format (WOFF) 1.0
 ExpiresByType application/font-woff "access plus 1 month"
 ExpiresByType application/x-font-woff "access plus 1 month"
 ExpiresByType font/woff "access plus 1 month"

 # Web Open Font Format (WOFF) 2.0
 ExpiresByType application/font-woff2 "access plus 1 month"

 # Other
 ExpiresByType text/x-cross-domain-policy "access plus 1 week"

#</IfModule>


# --- Suppress or force the "www." at the beginning of URLs ---

# Option 1 (Without www.):
<IfModule mod_rewrite.c>
 RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
 RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
</IfModule>

# Option 2 (With www.):
# <IfModule mod_rewrite.c>
# RewriteCond %{HTTPS} !=on
# RewriteCond %{HTTP_HOST} !^www\..+$ [NC]
# RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# </IfModule>



# --- Built-in filename-based cache busting ---

# /css/style.20110203.css to /css/style.css instead of /css/style.css?v=123

# Uncomment to enable.
#<IfModule mod_rewrite.c>
# RewriteCond %{REQUEST_FILENAME} !-f
# RewriteCond %{REQUEST_FILENAME} !-d
# RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L]
#</IfModule>



# --- Cross-domain AJAX requests ---

# Serve cross-domain ajax requests, disabled. 
# enable-cors.org
# code.google.com/p/html5security/wiki/CrossOriginRequestSecurity

<IfModule mod_headers.c>
# Header set Access-Control-Allow-Origin "*"
 Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>


# --- Rewrite url --- 

# Set change index folder
#DirectoryIndex /path/to/public/index.php /path/to/public/index.php

#Options +FollowSymLinks -MultiViews
RewriteEngine On
#RewriteBase /set/base/directory/
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?page=$1 [QSA,L]


# --- Some servers need this for REST to work --- 
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]


# Rewrite the folders ROOT
#RewriteEngine On
#RewriteCond $1 !^folder/folder/mySitesFolder/
#RewriteRule ^(.*)$ folder/folder/mySitesFolder/$1 [L]


# --- Global --- 

Options -MultiViews
#ErrorDocument 404 /404.html

AddDefaultCharset utf-8
AddCharset utf-8 .html .css .js .xml .json .rss .atom

#Make folders private
Options -Indexes

# Block access to hidden folders
<IfModule mod_rewrite.c>
 RewriteRule "(^|/)\." - [F]
</IfModule>

# Increase cookie security
<IfModule php5_module>
 php_value session.cookie_httponly true
</IfModule>

<filesMatch ".(js|css|webp|jpg|jpeg|png|gif|js|css|ico|swf|woff|woff2)$">
 Header set Cache-Control "max-age=31536000, public"
 Header unset Last-Modified
 Header unset ETag
 Header set X-Content-Type-Options nosniff
 Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</filesMatch>

FileETag None
