diff --git a/lib/h5bp-htaccess b/lib/h5bp-htaccess index 1a2a61b..8c9e6a9 100644 --- a/lib/h5bp-htaccess +++ b/lib/h5bp-htaccess @@ -22,206 +22,106 @@ ### the permalinks are flushed or set (see lib/htaccess.php) ### +# ############################################################################## +# # CROSS-ORIGIN RESOURCE SHARING (CORS) # +# ############################################################################## +# ------------------------------------------------------------------------------ +# | Cross-domain AJAX requests | +# ------------------------------------------------------------------------------ -# ---------------------------------------------------------------------- -# Better website experience for IE users -# ---------------------------------------------------------------------- - -# Force the latest IE version, in various cases when it may fall back to IE7 mode -# github.com/rails/rails/commit/123eb25#commitcomment-118920 -# Use ChromeFrame if it's installed for a better experience for the poor IE folk - - - Header set X-UA-Compatible "IE=edge,chrome=1" - # mod_headers can't match by content-type, but we don't want to send this header on *everything*... - - Header unset X-UA-Compatible - - - - -# ---------------------------------------------------------------------- -# Cross-domain AJAX requests -# ---------------------------------------------------------------------- - -# Serve cross-domain Ajax requests, disabled by default. -# enable-cors.org -# code.google.com/p/html5security/wiki/CrossOriginRequestSecurity - -# -# Header set Access-Control-Allow-Origin "*" -# - - -# ---------------------------------------------------------------------- -# CORS-enabled images (@crossorigin) -# ---------------------------------------------------------------------- - -# Send CORS headers if browsers request them; enabled by default for images. -# developer.mozilla.org/en/CORS_Enabled_Image -# blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html -# hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ -# wiki.mozilla.org/Security/Reviews/crossoriginAttribute - - - - # mod_headers, y u no match by Content-Type?! - - SetEnvIf Origin ":" IS_CORS - Header set Access-Control-Allow-Origin "*" env=IS_CORS - - - - - -# ---------------------------------------------------------------------- -# Webfont access -# ---------------------------------------------------------------------- - -# Allow access from all domains for webfonts. -# Alternatively you could only whitelist your -# subdomains like "subdomain.example.com". - - - - Header set Access-Control-Allow-Origin "*" - - - - -# ---------------------------------------------------------------------- -# Proper MIME type for all files -# ---------------------------------------------------------------------- - -# JavaScript -# Normalize to standard type (it's sniffed in IE anyways) -# tools.ietf.org/html/rfc4329#section-7.2 -AddType application/javascript js jsonp -AddType application/json json - -# Audio -AddType audio/mp4 m4a f4a f4b -AddType audio/ogg oga ogg - -# Video -AddType video/mp4 mp4 m4v f4v f4p -AddType video/ogg ogv -AddType video/webm webm -AddType video/x-flv flv - -# SVG -# Required for svg webfonts on iPad -# twitter.com/FontSquirrel/status/14855840545 -AddType image/svg+xml svg svgz -AddEncoding gzip svgz - -# Webfonts -AddType application/font-woff woff -AddType application/vnd.ms-fontobject eot -AddType application/x-font-ttf ttf ttc -AddType font/opentype otf - -# Assorted types -AddType application/octet-stream safariextz -AddType application/x-chrome-extension crx -AddType application/x-opera-extension oex -AddType application/x-shockwave-flash swf -AddType application/x-web-app-manifest+json webapp -AddType application/x-xpinstall xpi -AddType application/xml rss atom xml rdf -AddType image/webp webp -AddType image/x-icon ico -AddType text/cache-manifest appcache manifest -AddType text/vtt vtt -AddType text/x-component htc -AddType text/x-vcard vcf - - -# ---------------------------------------------------------------------- -# Allow concatenation from within specific js and css files -# ---------------------------------------------------------------------- - -# e.g. Inside of script.combined.js you could have -# -# -# and they would be included into this single file. - -# This is not in use in the boilerplate as it stands. You may -# choose to use this technique if you do not have a build process. - -# -# Options +Includes -# AddOutputFilterByType INCLUDES application/javascript application/json -# SetOutputFilter INCLUDES -# - -# -# Options +Includes -# AddOutputFilterByType INCLUDES text/css -# SetOutputFilter INCLUDES -# - - -# ---------------------------------------------------------------------- -# Gzip compression -# ---------------------------------------------------------------------- - - - - # Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ - - - SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding - RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding - - - - # Compress all output labeled with one of the following MIME-types - # (for Apache versions below 2.3.7, you don't need to enable `mod_filter` - # and can remove the `` and `` lines as - # `AddOutputFilterByType` is still in the core directives) - - AddOutputFilterByType DEFLATE application/atom+xml \ - application/javascript \ - application/json \ - application/rss+xml \ - application/vnd.ms-fontobject \ - application/x-font-ttf \ - application/xhtml+xml \ - application/xml \ - font/opentype \ - image/svg+xml \ - image/x-icon \ - text/css \ - text/html \ - text/plain \ - text/x-component \ - text/xml - - - - - -# ---------------------------------------------------------------------- -# Prevent mobile network providers from modifying your site -# ---------------------------------------------------------------------- - -# The following header prevents modification of your code over 3G on some -# European providers. -# This is the official 'bypass' suggested by O2 in the UK. +# Enable cross-origin AJAX requests. +# http://code.google.com/p/html5security/wiki/CrossOriginRequestSecurity +# http://enable-cors.org/ # -# Header set Cache-Control "no-transform" +# Header set Access-Control-Allow-Origin "*" # +# ------------------------------------------------------------------------------ +# | CORS-enabled images | +# ------------------------------------------------------------------------------ -# ---------------------------------------------------------------------- -# Stop screen flicker in IE on CSS rollovers -# ---------------------------------------------------------------------- +# Send the CORS header for images when browsers request it. +# https://developer.mozilla.org/en/CORS_Enabled_Image +# http://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html +# http://hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ -# The following directives stop screen flicker in IE on CSS rollovers - in -# combination with the "ExpiresByType" rules for images (see above). + + + + SetEnvIf Origin ":" IS_CORS + Header set Access-Control-Allow-Origin "*" env=IS_CORS + + + + +# ------------------------------------------------------------------------------ +# | Web fonts access | +# ------------------------------------------------------------------------------ + +# Allow access from all domains for web fonts + + + + Header set Access-Control-Allow-Origin "*" + + + + +# ############################################################################## +# # ERRORS # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | 404 error prevention for non-existing redirected folders | +# ------------------------------------------------------------------------------ + +# Prevent Apache from returning a 404 error for a rewrite if a directory +# with the same name does not exist. +# http://httpd.apache.org/docs/current/content-negotiation.html#multiviews +# http://www.webmasterworld.com/apache/3808792.htm + +# Options -MultiViews + + +# ############################################################################## +# # INTERNET EXPLORER # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | Better website experience | +# ------------------------------------------------------------------------------ + +# Force IE to render pages in the highest available mode in the various +# cases when it may not: http://hsivonen.iki.fi/doctype/ie-mode.pdf. +# Use, if installed, Google Chrome Frame. + + + Header set X-UA-Compatible "IE=edge,chrome=1" + # `mod_headers` can't match based on the content-type, however, we only + # want to send this header for HTML pages and not for the other resources + + Header unset X-UA-Compatible + + + +# ------------------------------------------------------------------------------ +# | Cookie setting from iframes | +# ------------------------------------------------------------------------------ + +# Allow cookies to be set from iframes in IE. + +# +# Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" +# + +# ------------------------------------------------------------------------------ +# | Screen flicker | +# ------------------------------------------------------------------------------ + +# Stop screen flicker in IE on CSS rollovers (this only works in +# combination with the `ExpiresByType` directives for images from below). # BrowserMatch "MSIE" brokenvary=1 # BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1 @@ -229,199 +129,293 @@ AddType text/x-vcard vcf # SetEnvIf brokenvary 1 force-no-vary -# ---------------------------------------------------------------------- -# Set Keep-Alive Header -# ---------------------------------------------------------------------- +# ############################################################################## +# # MIME TYPES AND ENCODING # +# ############################################################################## -# Keep-Alive allows the server to send multiple requests through one -# TCP-connection. Be aware of possible disadvantages of this setting. Turn on -# if you serve a lot of static content. +# ------------------------------------------------------------------------------ +# | Proper MIME types for all files | +# ------------------------------------------------------------------------------ -# -# Header set Connection Keep-Alive -# + + # Audio + AddType audio/mp4 m4a f4a f4b + AddType audio/ogg oga ogg -# ---------------------------------------------------------------------- -# Cookie setting from iframes -# ---------------------------------------------------------------------- + # JavaScript + # Normalize to standard type (it's sniffed in IE anyways): + # http://tools.ietf.org/html/rfc4329#section-7.2 + AddType application/javascript js jsonp + AddType application/json json -# Allow cookies to be set from iframes (for IE only) -# If needed, specify a path or regex in the Location directive. + # Video + AddType video/mp4 mp4 m4v f4v f4p + AddType video/ogg ogv + AddType video/webm webm + AddType video/x-flv flv -# -# Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" -# + # Web fonts + AddType application/font-woff woff + AddType application/vnd.ms-fontobject eot + # Browsers usually ignore the font MIME types and sniff the content, + # however, Chrome shows a warning if other MIME types are used for the + # following fonts. + AddType application/x-font-ttf ttc ttf + AddType font/opentype otf -# ---------------------------------------------------------------------- -# Built-in filename-based cache busting -# ---------------------------------------------------------------------- + # Make SVGZ fonts work on iPad: + # https://twitter.com/FontSquirrel/status/14855840545 + AddType image/svg+xml svg svgz + AddEncoding gzip svgz -# If you're not using the build script to manage your filename version revving, -# you might want to consider enabling this, which will route requests for -# `/css/style.20110203.css` to `/css/style.css`. + # Other + AddType application/octet-stream safariextz + AddType application/x-chrome-extension crx + AddType application/x-opera-extension oex + AddType application/x-shockwave-flash swf + AddType application/x-web-app-manifest+json webapp + AddType application/x-xpinstall xpi + AddType application/xml atom rdf rss xml + AddType image/webp webp + AddType image/x-icon ico + AddType text/cache-manifest appcache manifest + AddType text/vtt vtt + AddType text/x-component htc + AddType text/x-vcard vcf -# To understand why this is important and a better idea than all.css?v1231, -# please refer to the bundled documentation about `.htaccess`. + -# -# RewriteCond %{REQUEST_FILENAME} !-f -# RewriteCond %{REQUEST_FILENAME} !-d -# RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L] -# +# ------------------------------------------------------------------------------ +# | UTF-8 encoding | +# ------------------------------------------------------------------------------ - -# ---------------------------------------------------------------------- -# Prevent SSL cert warnings -# ---------------------------------------------------------------------- - -# Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent -# https://www.example.com when your cert only allows https://secure.example.com - -# -# RewriteCond %{SERVER_PORT} !^443 -# RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L] -# - - -# ---------------------------------------------------------------------- -# Force client-side SSL redirection -# ---------------------------------------------------------------------- - -# If a user types "example.com" in her browser, the above rule will redirect her -# to the secure version of the site. That still leaves a window of opportunity -# (the initial HTTP connection) for an attacker to downgrade or redirect the -# request. The following header ensures that browser will **only** connect to -# your server via HTTPS, regardless of what users type in the address bar. - -# -# Header set Strict-Transport-Security max-age=16070400; -# - - -# ---------------------------------------------------------------------- -# Prevent 404 errors for non-existing redirected folders -# ---------------------------------------------------------------------- - -# without -MultiViews, Apache will give a 404 for a rewrite if a folder of the -# same name does not exist. -# webmasterworld.com/apache/3808792.htm - -# Options -MultiViews - - -# ---------------------------------------------------------------------- -# UTF-8 encoding -# ---------------------------------------------------------------------- - -# Use UTF-8 encoding for anything served text/plain or text/html +# Use UTF-8 encoding for anything served as `text/html` or `text/plain`. AddDefaultCharset utf-8 -# Force UTF-8 for a number of file formats -AddCharset utf-8 .atom .css .js .json .rss .vtt .xml +# Force UTF-8 for certain file formats. + + AddCharset utf-8 .atom .css .js .json .rss .vtt .webapp .xml + -# ---------------------------------------------------------------------- -# A little more security -# ---------------------------------------------------------------------- +# ############################################################################## +# # SECURITY # +# ############################################################################## -# To avoid displaying the exact version number of Apache being used, add the -# following to httpd.conf (it will not work in .htaccess): -# ServerTokens Prod +# ------------------------------------------------------------------------------ +# | Content Security Policy (CSP) | +# ------------------------------------------------------------------------------ + +# You can mitigate the risk of cross-site scripting and other content-injection +# attacks by setting a Content Security Policy which whitelists trusted sources +# of content for your site. + +# The example header below allows ONLY scripts that are loaded from the current +# site's origin (no inline scripts, no CDN, etc). This almost certainly won't +# work as-is for your site! + +# To get all the details you'll need to craft a reasonable policy for your site, +# read: http://html5rocks.com/en/tutorials/security/content-security-policy (or +# see the specification: http://w3.org/TR/CSP). + +# +# Header set Content-Security-Policy "script-src 'self'; object-src 'self'" +# +# Header unset Content-Security-Policy +# +# + +# ------------------------------------------------------------------------------ +# | File access | +# ------------------------------------------------------------------------------ + +# Block access to directories without a default document. +# Usually you should leave this uncommented because you shouldn't allow anyone +# to surf through every directory on your server (which may includes rather +# private places like the CMS's directories). -# "-Indexes" will have Apache block users from browsing folders without a -# default document Usually you should leave this activated, because you -# shouldn't allow everybody to surf through every folder on your server (which -# includes rather private places like CMS system folders). - Options -Indexes + Options -Indexes -# Block access to "hidden" directories or files whose names begin with a -# period. This includes directories used by version control systems such as -# Subversion or Git. +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Block access to hidden files and directories. +# This includes directories used by version control systems such as Git and SVN. + - RewriteCond %{SCRIPT_FILENAME} -d [OR] - RewriteCond %{SCRIPT_FILENAME} -f - RewriteRule "(^|/)\." - [F] + RewriteCond %{SCRIPT_FILENAME} -d [OR] + RewriteCond %{SCRIPT_FILENAME} -f + RewriteRule "(^|/)\." - [F] -# Block access to backup and source files. These files may be left by some -# text/html editors and pose a great security danger, when anyone can access -# them. - - Order allow,deny - Deny from all - Satisfy All +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Block access to backup and source files. +# These files may be left by some text editors and can pose a great security +# danger when anyone has access to them. + + + Order allow,deny + Deny from all + Satisfy All # Block access to WordPress files that reveal version information. - Order allow,deny - Deny from all - Satisfy All + Order allow,deny + Deny from all + Satisfy All -# If your server is not already configured as such, the following directive -# should be uncommented in order to set PHP's register_globals option to OFF. -# This closes a major security hole that is abused by most XSS (cross-site -# scripting) attacks. For more information: http://php.net/register_globals -# -# IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS: -# -# Your server does not allow PHP directives to be set via .htaccess. In that -# case you must make this change in your php.ini file instead. If you are -# using a commercial web host, contact the administrators for assistance in -# doing this. Not all servers allow local php.ini files, and they should -# include all PHP configurations (not just this one), or you will effectively -# reset everything to PHP defaults. Consult www.php.net for more detailed -# information about setting PHP directives. +# ------------------------------------------------------------------------------ +# | Secure Sockets Layer (SSL) | +# ------------------------------------------------------------------------------ -# php_flag register_globals Off +# Rewrite secure requests properly to prevent SSL certificate warnings, e.g.: +# prevent `https://www.example.com` when your certificate only allows +# `https://secure.example.com`. -# Rename session cookie to something else, than PHPSESSID -# php_value session.name sid +# +# RewriteCond %{SERVER_PORT} !^443 +# RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L] +# -# Disable magic quotes (This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.) -# php_flag magic_quotes_gpc Off +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -# Do not show you are using PHP -# Note: Move this line to php.ini since it won't work in .htaccess -# php_flag expose_php Off +# Force client-side SSL redirection. -# Level of log detail - log all errors -# php_value error_reporting -1 +# If a user types "example.com" in his browser, the above rule will redirect him +# to the secure version of the site. That still leaves a window of opportunity +# (the initial HTTP connection) for an attacker to downgrade or redirect the +# request. The following header ensures that browser will ONLY connect to your +# server via HTTPS, regardless of what the users type in the address bar. +# http://www.html5rocks.com/en/tutorials/security/transport-layer-security/ -# Write errors to log file -# php_flag log_errors On +# +# Header set Strict-Transport-Security max-age=16070400; +# -# Do not display errors in browser (production - Off, development - On) -# php_flag display_errors Off +# ------------------------------------------------------------------------------ +# | Server software information | +# ------------------------------------------------------------------------------ -# Do not display startup errors (production - Off, development - On) -# php_flag display_startup_errors Off +# Avoid displaying the exact Apache version number, the description of the +# generic OS-type and the information about Apache's compiled-in modules. -# Format errors in plain text -# Note: Leave this setting 'On' for xdebug's var_dump() output -# php_flag html_errors Off +# ADD THIS DIRECTIVE IN THE `httpd.conf` AS IT WILL NOT WORK IN THE `.htaccess`! -# Show multiple occurrence of error -# php_flag ignore_repeated_errors Off +# ServerTokens Prod -# Show same errors from different sources -# php_flag ignore_repeated_source Off -# Size limit for error messages -# php_value log_errors_max_len 1024 +# ############################################################################## +# # WEB PERFORMANCE # +# ############################################################################## -# Don't precede error with string (doesn't accept empty string, use whitespace if you need) -# php_value error_prepend_string " " +# ------------------------------------------------------------------------------ +# | Compression | +# ------------------------------------------------------------------------------ -# Don't prepend to error (doesn't accept empty string, use whitespace if you need) -# php_value error_append_string " " + + + # Force compression for mangled headers. + # http://developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping + + + SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding + RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding + + + + # Compress all output labeled with one of the following MIME-types + # (for Apache versions below 2.3.7, you don't need to enable `mod_filter` + # and can remove the `` and `` lines + # as `AddOutputFilterByType` is still in the core directives). + + AddOutputFilterByType DEFLATE application/atom+xml \ + application/javascript \ + application/json \ + application/rss+xml \ + application/vnd.ms-fontobject \ + application/x-font-ttf \ + application/x-web-app-manifest+json \ + application/xhtml+xml \ + application/xml \ + font/opentype \ + image/svg+xml \ + image/x-icon \ + text/css \ + text/html \ + text/plain \ + text/x-component \ + text/xml + -# Increase cookie security - - php_value session.cookie_httponly true + +# ------------------------------------------------------------------------------ +# | Content transformations | +# ------------------------------------------------------------------------------ + +# Prevent some of the mobile network providers from modifying the content of +# your site: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.5. + +# +# Header set Cache-Control "no-transform" +# + +# ------------------------------------------------------------------------------ +# | Filename-based cache busting | +# ------------------------------------------------------------------------------ + +# If you're not using a build process to manage your filename version revving, +# you might want to consider enabling the following directives to route all +# requests such as `/css/style.12345.css` to `/css/style.css`. + +# To understand why this is important and a better idea than `*.css?v231`, read: +# http://stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring + +# +# RewriteCond %{REQUEST_FILENAME} !-f +# RewriteCond %{REQUEST_FILENAME} !-d +# RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L] +# + +# ------------------------------------------------------------------------------ +# | File concatenation | +# ------------------------------------------------------------------------------ + +# Allow concatenation from within specific CSS and JS files, e.g.: +# Inside of `script.combined.js` you could have +# +# +# and they would be included into this single file. + +# +# +# Options +Includes +# AddOutputFilterByType INCLUDES application/javascript application/json +# SetOutputFilter INCLUDES +# +# +# Options +Includes +# AddOutputFilterByType INCLUDES text/css +# SetOutputFilter INCLUDES +# +# + +# ------------------------------------------------------------------------------ +# | Persistent connections | +# ------------------------------------------------------------------------------ + +# Allow multiple requests to be sent over the same TCP connection: +# http://httpd.apache.org/docs/current/en/mod/core.html#keepalive. + +# Enable if you serve a lot of static content but, be aware of the +# possible disadvantages! + +# +# Header set Connection Keep-Alive +#