The source code for exposé websites [https://jonathanyaniv.org] and [https://jessicayaniv.org]. https://jonathanyaniv.org
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

.htaccess 47KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177
  1. # Apache Server Configs v3.0.0 | MIT License
  2. # https://github.com/h5bp/server-configs-apache
  3. # (!) Using `.htaccess` files slows down Apache, therefore, if you have
  4. # access to the main server configuration file (which is usually called
  5. # `httpd.conf`), you should add this logic there.
  6. #
  7. # https://httpd.apache.org/docs/current/howto/htaccess.html
  8. # ######################################################################
  9. # # CROSS-ORIGIN #
  10. # ######################################################################
  11. # ----------------------------------------------------------------------
  12. # | Cross-origin requests |
  13. # ----------------------------------------------------------------------
  14. # Allow cross-origin requests.
  15. #
  16. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
  17. # https://enable-cors.org/
  18. # https://www.w3.org/TR/cors/
  19. # <IfModule mod_headers.c>
  20. # Header set Access-Control-Allow-Origin "*"
  21. # </IfModule>
  22. # ----------------------------------------------------------------------
  23. # | Cross-origin images |
  24. # ----------------------------------------------------------------------
  25. # Send the CORS header for images when browsers request it.
  26. #
  27. # https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image
  28. # https://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html
  29. <IfModule mod_setenvif.c>
  30. <IfModule mod_headers.c>
  31. <FilesMatch "\.(bmp|cur|gif|ico|jpe?g|png|svgz?|webp)$">
  32. SetEnvIf Origin ":" IS_CORS
  33. Header set Access-Control-Allow-Origin "*" env=IS_CORS
  34. </FilesMatch>
  35. </IfModule>
  36. </IfModule>
  37. # ----------------------------------------------------------------------
  38. # | Cross-origin web fonts |
  39. # ----------------------------------------------------------------------
  40. # Allow cross-origin access to web fonts.
  41. <IfModule mod_headers.c>
  42. <FilesMatch "\.(eot|otf|tt[cf]|woff2?)$">
  43. Header set Access-Control-Allow-Origin "*"
  44. </FilesMatch>
  45. </IfModule>
  46. # ----------------------------------------------------------------------
  47. # | Cross-origin resource timing |
  48. # ----------------------------------------------------------------------
  49. # Allow cross-origin access to the timing information for all resources.
  50. #
  51. # If a resource isn't served with a `Timing-Allow-Origin` header that
  52. # would allow its timing information to be shared with the document,
  53. # some of the attributes of the `PerformanceResourceTiming` object will
  54. # be set to zero.
  55. #
  56. # https://www.w3.org/TR/resource-timing/
  57. # http://www.stevesouders.com/blog/2014/08/21/resource-timing-practical-tips/
  58. # <IfModule mod_headers.c>
  59. # Header set Timing-Allow-Origin: "*"
  60. # </IfModule>
  61. # ######################################################################
  62. # # ERRORS #
  63. # ######################################################################
  64. # ----------------------------------------------------------------------
  65. # | Custom error messages/pages |
  66. # ----------------------------------------------------------------------
  67. # Customize what Apache returns to the client in case of an error.
  68. # https://httpd.apache.org/docs/current/mod/core.html#errordocument
  69. ErrorDocument 404 /404.html
  70. # ----------------------------------------------------------------------
  71. # | Error prevention |
  72. # ----------------------------------------------------------------------
  73. # Disable the pattern matching based on filenames.
  74. #
  75. # This setting prevents Apache from returning a 404 error as the result
  76. # of a rewrite when the directory with the same name does not exist.
  77. #
  78. # https://httpd.apache.org/docs/current/content-negotiation.html#multiviews
  79. Options -MultiViews
  80. # ######################################################################
  81. # # INTERNET EXPLORER #
  82. # ######################################################################
  83. # ----------------------------------------------------------------------
  84. # | Document modes |
  85. # ----------------------------------------------------------------------
  86. # Force Internet Explorer 8/9/10 to render pages in the highest mode
  87. # available in the various cases when it may not.
  88. #
  89. # https://hsivonen.fi/doctype/#ie8
  90. #
  91. # (!) Starting with Internet Explorer 11, document modes are deprecated.
  92. # If your business still relies on older web apps and services that were
  93. # designed for older versions of Internet Explorer, you might want to
  94. # consider enabling `Enterprise Mode` throughout your company.
  95. #
  96. # https://msdn.microsoft.com/en-us/library/ie/bg182625.aspx#docmode
  97. # https://blogs.msdn.microsoft.com/ie/2014/04/02/stay-up-to-date-with-enterprise-mode-for-internet-explorer-11/
  98. <IfModule mod_headers.c>
  99. Header set X-UA-Compatible "IE=edge"
  100. # `mod_headers` cannot match based on the content-type, however,
  101. # the `X-UA-Compatible` response header should be send only for
  102. # HTML documents and not for the other resources.
  103. <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
  104. Header unset X-UA-Compatible
  105. </FilesMatch>
  106. </IfModule>
  107. # ----------------------------------------------------------------------
  108. # | Iframes cookies |
  109. # ----------------------------------------------------------------------
  110. # Allow cookies to be set from iframes in Internet Explorer.
  111. #
  112. # https://msdn.microsoft.com/en-us/library/ms537343.aspx
  113. # https://www.w3.org/TR/2000/CR-P3P-20001215/
  114. # <IfModule mod_headers.c>
  115. # Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\""
  116. # </IfModule>
  117. # ######################################################################
  118. # # MEDIA TYPES AND CHARACTER ENCODINGS #
  119. # ######################################################################
  120. # ----------------------------------------------------------------------
  121. # | Media types |
  122. # ----------------------------------------------------------------------
  123. # Serve resources with the proper media types (f.k.a. MIME types).
  124. #
  125. # https://www.iana.org/assignments/media-types/media-types.xhtml
  126. # https://httpd.apache.org/docs/current/mod/mod_mime.html#addtype
  127. <IfModule mod_mime.c>
  128. # Data interchange
  129. AddType application/atom+xml atom
  130. AddType application/json json map topojson
  131. AddType application/ld+json jsonld
  132. AddType application/rss+xml rss
  133. AddType application/vnd.geo+json geojson
  134. AddType application/xml rdf xml
  135. # JavaScript
  136. # Servers should use text/javascript for JavaScript resources.
  137. # https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguages
  138. AddType text/javascript js mjs
  139. # Manifest files
  140. AddType application/manifest+json webmanifest
  141. AddType application/x-web-app-manifest+json webapp
  142. AddType text/cache-manifest appcache
  143. # Media files
  144. AddType audio/mp4 f4a f4b m4a
  145. AddType audio/ogg oga ogg opus
  146. AddType image/bmp bmp
  147. AddType image/svg+xml svg svgz
  148. AddType image/webp webp
  149. AddType video/mp4 f4v f4p m4v mp4
  150. AddType video/ogg ogv
  151. AddType video/webm webm
  152. AddType video/x-flv flv
  153. # Serving `.ico` image files with a different media type
  154. # prevents Internet Explorer from displaying them as images:
  155. # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee
  156. AddType image/x-icon cur ico
  157. # WebAssembly
  158. AddType application/wasm wasm
  159. # Web fonts
  160. AddType font/woff woff
  161. AddType font/woff2 woff2
  162. AddType application/vnd.ms-fontobject eot
  163. AddType font/ttf ttf
  164. AddType font/collection ttc
  165. AddType font/otf otf
  166. # Other
  167. AddType application/octet-stream safariextz
  168. AddType application/x-bb-appworld bbaw
  169. AddType application/x-chrome-extension crx
  170. AddType application/x-opera-extension oex
  171. AddType application/x-xpinstall xpi
  172. AddType text/calendar ics
  173. AddType text/markdown markdown md
  174. AddType text/vcard vcard vcf
  175. AddType text/vnd.rim.location.xloc xloc
  176. AddType text/vtt vtt
  177. AddType text/x-component htc
  178. </IfModule>
  179. # ----------------------------------------------------------------------
  180. # | Character encodings |
  181. # ----------------------------------------------------------------------
  182. # Serve all resources labeled as `text/html` or `text/plain`
  183. # with the media type `charset` parameter set to `UTF-8`.
  184. #
  185. # https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset
  186. AddDefaultCharset utf-8
  187. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  188. # Serve the following file types with the media type `charset`
  189. # parameter set to `UTF-8`.
  190. #
  191. # https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset
  192. <IfModule mod_mime.c>
  193. AddCharset utf-8 .atom \
  194. .bbaw \
  195. .css \
  196. .geojson \
  197. .ics \
  198. .js \
  199. .json \
  200. .jsonld \
  201. .manifest \
  202. .markdown \
  203. .md \
  204. .mjs \
  205. .rdf \
  206. .rss \
  207. .topojson \
  208. .vtt \
  209. .webapp \
  210. .webmanifest \
  211. .xloc \
  212. .xml
  213. </IfModule>
  214. # ######################################################################
  215. # # REWRITES #
  216. # ######################################################################
  217. # ----------------------------------------------------------------------
  218. # | Rewrite engine |
  219. # ----------------------------------------------------------------------
  220. # (1) Turn on the rewrite engine (this is necessary in order for
  221. # the `RewriteRule` directives to work).
  222. #
  223. # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#RewriteEngine
  224. #
  225. # (2) Enable the `FollowSymLinks` option if it isn't already.
  226. #
  227. # https://httpd.apache.org/docs/current/mod/core.html#options
  228. #
  229. # (3) If your web host doesn't allow the `FollowSymlinks` option,
  230. # you need to comment it out or remove it, and then uncomment
  231. # the `Options +SymLinksIfOwnerMatch` line (4), but be aware
  232. # of the performance impact.
  233. #
  234. # https://httpd.apache.org/docs/current/misc/perf-tuning.html#symlinks
  235. #
  236. # (4) Some cloud hosting services will require you set `RewriteBase`.
  237. #
  238. # https://www.rackspace.com/knowledge_center/frequently-asked-question/why-is-modrewrite-not-working-on-my-site
  239. # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritebase
  240. #
  241. # (5) Depending on how your server is set up, you may also need to
  242. # use the `RewriteOptions` directive to enable some options for
  243. # the rewrite engine.
  244. #
  245. # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewriteoptions
  246. #
  247. # (6) Set %{ENV:PROTO} variable, to allow rewrites to redirect with the
  248. # appropriate schema automatically (http or https).
  249. <IfModule mod_rewrite.c>
  250. # (1)
  251. RewriteEngine On
  252. # (2)
  253. Options +FollowSymlinks
  254. # (3)
  255. # Options +SymLinksIfOwnerMatch
  256. # (4)
  257. # RewriteBase /
  258. # (5)
  259. # RewriteOptions <options>
  260. # (6)
  261. RewriteCond %{HTTPS} =on
  262. RewriteRule ^ - [env=proto:https]
  263. RewriteCond %{HTTPS} !=on
  264. RewriteRule ^ - [env=proto:http]
  265. </IfModule>
  266. # ----------------------------------------------------------------------
  267. # | Forcing `https://` |
  268. # ----------------------------------------------------------------------
  269. # Redirect from the `http://` to the `https://` version of the URL.
  270. # https://wiki.apache.org/httpd/RewriteHTTPToHTTPS
  271. # <IfModule mod_rewrite.c>
  272. # RewriteEngine On
  273. # RewriteCond %{HTTPS} !=on
  274. # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  275. # </IfModule>
  276. # ----------------------------------------------------------------------
  277. # | Suppressing the `www.` at the beginning of URLs |
  278. # ----------------------------------------------------------------------
  279. # Rewrite www.example.com → example.com
  280. # The same content should never be available under two different
  281. # URLs, especially not with and without `www.` at the beginning.
  282. # This can cause SEO problems (duplicate content), and therefore,
  283. # you should choose one of the alternatives and redirect the other
  284. # one.
  285. #
  286. # (!) NEVER USE BOTH WWW-RELATED RULES AT THE SAME TIME!
  287. # (1) The rule assume by default that both HTTP and HTTPS
  288. # environments are available for redirection.
  289. # If your SSL certificate could not handle one of the domains
  290. # used during redirection, you should turn the condition on.
  291. #
  292. # https://github.com/h5bp/server-configs-apache/issues/52
  293. <IfModule mod_rewrite.c>
  294. RewriteEngine On
  295. # (1)
  296. # RewriteCond %{HTTPS} !=on
  297. RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  298. RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
  299. </IfModule>
  300. # ----------------------------------------------------------------------
  301. # | Forcing the `www.` at the beginning of URLs |
  302. # ----------------------------------------------------------------------
  303. # Rewrite example.com → www.example.com
  304. # The same content should never be available under two different
  305. # URLs, especially not with and without `www.` at the beginning.
  306. # This can cause SEO problems (duplicate content), and therefore,
  307. # you should choose one of the alternatives and redirect the other
  308. # one.
  309. #
  310. # (!) NEVER USE BOTH WWW-RELATED RULES AT THE SAME TIME!
  311. # (1) The rule assume by default that both HTTP and HTTPS
  312. # environments are available for redirection.
  313. # If your SSL certificate could not handle one of the domains
  314. # used during redirection, you should turn the condition on.
  315. #
  316. # https://github.com/h5bp/server-configs-apache/issues/52
  317. # Be aware that the following might not be a good idea if you use "real"
  318. # subdomains for certain parts of your website.
  319. # <IfModule mod_rewrite.c>
  320. # RewriteEngine On
  321. # # (1)
  322. # # RewriteCond %{HTTPS} !=on
  323. # RewriteCond %{HTTP_HOST} !^www\. [NC]
  324. # RewriteCond %{SERVER_ADDR} !=127.0.0.1
  325. # RewriteCond %{SERVER_ADDR} !=::1
  326. # RewriteRule ^ %{ENV:PROTO}://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  327. # </IfModule>
  328. # ######################################################################
  329. # # SECURITY #
  330. # ######################################################################
  331. # ----------------------------------------------------------------------
  332. # | Clickjacking |
  333. # ----------------------------------------------------------------------
  334. # Protect website against clickjacking.
  335. #
  336. # The example below sends the `X-Frame-Options` response header with
  337. # the value `DENY`, informing browsers not to display the content of
  338. # the web page in any frame.
  339. #
  340. # This might not be the best setting for everyone. You should read
  341. # about the other two possible values the `X-Frame-Options` header
  342. # field can have: `SAMEORIGIN` and `ALLOW-FROM`.
  343. # https://tools.ietf.org/html/rfc7034#section-2.1.
  344. #
  345. # Keep in mind that while you could send the `X-Frame-Options` header
  346. # for all of your website’s pages, this has the potential downside that
  347. # it forbids even non-malicious framing of your content (e.g.: when
  348. # users visit your website using a Google Image Search results page).
  349. #
  350. # Nonetheless, you should ensure that you send the `X-Frame-Options`
  351. # header for all pages that allow a user to make a state changing
  352. # operation (e.g: pages that contain one-click purchase links, checkout
  353. # or bank-transfer confirmation pages, pages that make permanent
  354. # configuration changes, etc.).
  355. #
  356. # Sending the `X-Frame-Options` header can also protect your website
  357. # against more than just clickjacking attacks:
  358. # https://cure53.de/xfo-clickjacking.pdf.
  359. #
  360. # https://tools.ietf.org/html/rfc7034
  361. # https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/
  362. # https://www.owasp.org/index.php/Clickjacking
  363. # <IfModule mod_headers.c>
  364. # Header set X-Frame-Options "DENY"
  365. # # `mod_headers` cannot match based on the content-type, however,
  366. # # the `X-Frame-Options` response header should be send only for
  367. # # HTML documents and not for the other resources.
  368. # <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
  369. # Header unset X-Frame-Options
  370. # </FilesMatch>
  371. # </IfModule>
  372. # ----------------------------------------------------------------------
  373. # | Content Security Policy (CSP) |
  374. # ----------------------------------------------------------------------
  375. # Mitigate the risk of cross-site scripting and other content-injection
  376. # attacks.
  377. #
  378. # This can be done by setting a `Content Security Policy` which
  379. # whitelists trusted sources of content for your website.
  380. #
  381. # The example header below allows ONLY scripts that are loaded from
  382. # the current website's origin (no inline scripts, no CDN, etc).
  383. # That almost certainly won't work as-is for your website!
  384. #
  385. # To make things easier, you can use an online CSP header generator
  386. # such as: http://cspisawesome.com/.
  387. #
  388. # https://content-security-policy.com/
  389. # https://www.html5rocks.com/en/tutorials/security/content-security-policy/
  390. # https://w3c.github.io/webappsec-csp/
  391. # <IfModule mod_headers.c>
  392. # Header set Content-Security-Policy "script-src 'self'; object-src 'self'"
  393. # # `mod_headers` cannot match based on the content-type, however,
  394. # # the `Content-Security-Policy` response header should be send
  395. # # only for HTML documents and not for the other resources.
  396. # <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
  397. # Header unset Content-Security-Policy
  398. # </FilesMatch>
  399. # </IfModule>
  400. # ----------------------------------------------------------------------
  401. # | File access |
  402. # ----------------------------------------------------------------------
  403. # Block access to directories without a default document.
  404. #
  405. # You should leave the following uncommented, as you shouldn't allow
  406. # anyone to surf through every directory on your server (which may
  407. # includes rather private places such as the CMS's directories).
  408. <IfModule mod_autoindex.c>
  409. Options -Indexes
  410. </IfModule>
  411. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  412. # Block access to all hidden files and directories with the exception of
  413. # the visible content from within the `/.well-known/` hidden directory.
  414. #
  415. # These types of files usually contain user preferences or the preserved
  416. # state of an utility, and can include rather private places like, for
  417. # example, the `.git` or `.svn` directories.
  418. #
  419. # The `/.well-known/` directory represents the standard (RFC 5785) path
  420. # prefix for "well-known locations" (e.g.: `/.well-known/manifest.json`,
  421. # `/.well-known/keybase.txt`), and therefore, access to its visible
  422. # content should not be blocked.
  423. #
  424. # https://www.mnot.net/blog/2010/04/07/well-known
  425. # https://tools.ietf.org/html/rfc5785
  426. <IfModule mod_rewrite.c>
  427. RewriteEngine On
  428. RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
  429. RewriteCond %{SCRIPT_FILENAME} -d [OR]
  430. RewriteCond %{SCRIPT_FILENAME} -f
  431. RewriteRule "(^|/)\." - [F]
  432. </IfModule>
  433. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  434. # Block access to files that can expose sensitive information.
  435. #
  436. # By default, block access to backup and source files that may be
  437. # left by some text editors and can pose a security risk when anyone
  438. # has access to them.
  439. #
  440. # https://feross.org/cmsploit/
  441. #
  442. # (!) Update the `<FilesMatch>` regular expression from below to
  443. # include any files that might end up on your production server and
  444. # can expose sensitive information about your website. These files may
  445. # include: configuration files, files that contain metadata about the
  446. # project (e.g.: project dependencies), build scripts, etc..
  447. <IfModule mod_authz_core.c>
  448. <FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$">
  449. Require all denied
  450. </FilesMatch>
  451. </IfModule>
  452. # ----------------------------------------------------------------------
  453. # | HTTP Strict Transport Security (HSTS) |
  454. # ----------------------------------------------------------------------
  455. # Force client-side SSL redirection.
  456. #
  457. # If a user types `example.com` in their browser, even if the server
  458. # redirects them to the secure version of the website, that still leaves
  459. # a window of opportunity (the initial HTTP connection) for an attacker
  460. # to downgrade or redirect the request.
  461. #
  462. # The following header ensures that browser will ONLY connect to your
  463. # server via HTTPS, regardless of what the users type in the browser's
  464. # address bar.
  465. #
  466. # (!) Be aware that this, once published, is not revokable and you must ensure
  467. # being able to serve the site via SSL for the duration you've specified
  468. # in max-age. When you don't have a valid SSL connection (anymore) your
  469. # visitors will see a nasty error message even when attempting to connect
  470. # via simple HTTP.
  471. #
  472. # (!) Remove the `includeSubDomains` optional directive if the website's
  473. # subdomains are not using HTTPS.
  474. #
  475. # (1) If you want to submit your site for HSTS preload (2) you must
  476. # * ensure the `includeSubDomains` directive to be present
  477. # * the `preload` directive to be specified
  478. # * the `max-age` to be at least 31536000 seconds (1 year) according to the current status.
  479. #
  480. # It is also advised (3) to only serve the HSTS header via a secure connection
  481. # which can be done with either `env=https` or `"expr=%{HTTPS} == 'on'"` (4). The
  482. # exact way depends on your environment and might just be tried.
  483. #
  484. # https://www.html5rocks.com/en/tutorials/security/transport-layer-security/
  485. # https://tools.ietf.org/html/rfc6797#section-6.1
  486. # https://blogs.msdn.microsoft.com/ieinternals/2014/08/18/strict-transport-security/
  487. # (2) https://hstspreload.org/
  488. # (3) https://tools.ietf.org/html/rfc6797#section-7.2
  489. # (4) https://stackoverflow.com/questions/24144552/how-to-set-hsts-header-from-htaccess-only-on-https/24145033#comment81632711_24145033
  490. # <IfModule mod_headers.c>
  491. # Header always set Strict-Transport-Security "max-age=16070400; includeSubDomains"
  492. # # (1) or if HSTS preloading is desired (respect (2) for current requirements):
  493. # # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
  494. # # (4) respectively… (respect (2) for current requirements):
  495. # # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" "expr=%{HTTPS} == 'on'"
  496. # </IfModule>
  497. # ----------------------------------------------------------------------
  498. # | Reducing MIME type security risks |
  499. # ----------------------------------------------------------------------
  500. # Prevent some browsers from MIME-sniffing the response.
  501. #
  502. # This reduces exposure to drive-by download attacks and cross-origin
  503. # data leaks, and should be left uncommented, especially if the server
  504. # is serving user-uploaded content or content that could potentially be
  505. # treated as executable by the browser.
  506. #
  507. # https://www.slideshare.net/hasegawayosuke/owasp-hasegawa
  508. # https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/
  509. # https://msdn.microsoft.com/en-us/library/ie/gg622941.aspx
  510. # https://mimesniff.spec.whatwg.org/
  511. <IfModule mod_headers.c>
  512. Header set X-Content-Type-Options "nosniff"
  513. </IfModule>
  514. # ----------------------------------------------------------------------
  515. # | Reflected Cross-Site Scripting (XSS) attacks |
  516. # ----------------------------------------------------------------------
  517. # (1) Try to re-enable the cross-site scripting (XSS) filter built
  518. # into most web browsers.
  519. #
  520. # The filter is usually enabled by default, but in some cases it
  521. # may be disabled by the user. However, in Internet Explorer for
  522. # example, it can be re-enabled just by sending the
  523. # `X-XSS-Protection` header with the value of `1`.
  524. #
  525. # (2) Prevent web browsers from rendering the web page if a potential
  526. # reflected (a.k.a non-persistent) XSS attack is detected by the
  527. # filter.
  528. #
  529. # By default, if the filter is enabled and browsers detect a
  530. # reflected XSS attack, they will attempt to block the attack
  531. # by making the smallest possible modifications to the returned
  532. # web page.
  533. #
  534. # Unfortunately, in some browsers (e.g.: Internet Explorer),
  535. # this default behavior may allow the XSS filter to be exploited,
  536. # thereby, it's better to inform browsers to prevent the rendering
  537. # of the page altogether, instead of attempting to modify it.
  538. #
  539. # https://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities
  540. #
  541. # (!) Do not rely on the XSS filter to prevent XSS attacks! Ensure that
  542. # you are taking all possible measures to prevent XSS attacks, the
  543. # most obvious being: validating and sanitizing your website's inputs.
  544. #
  545. # https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-iv-the-xss-filter/
  546. # https://blogs.msdn.microsoft.com/ieinternals/2011/01/31/controlling-the-xss-filter/
  547. # https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
  548. # <IfModule mod_headers.c>
  549. # # (1) (2)
  550. # Header set X-XSS-Protection "1; mode=block"
  551. # # `mod_headers` cannot match based on the content-type, however,
  552. # # the `X-XSS-Protection` response header should be send only for
  553. # # HTML documents and not for the other resources.
  554. # <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
  555. # Header unset X-XSS-Protection
  556. # </FilesMatch>
  557. # </IfModule>
  558. # ----------------------------------------------------------------------
  559. # | Referrer Policy |
  560. # ----------------------------------------------------------------------
  561. # A web application uses HTTPS and a URL-based session identifier.
  562. # The web application might wish to link to HTTPS resources on other
  563. # web sites without leaking the user's session identifier in the URL.
  564. #
  565. # This can be done by setting a `Referrer Policy` which
  566. # whitelists trusted sources of content for your website.
  567. #
  568. # To check your referrer policy, you can use an online service
  569. # such as: https://securityheaders.io/.
  570. #
  571. # https://scotthelme.co.uk/a-new-security-header-referrer-policy/
  572. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
  573. # <IfModule mod_headers.c>
  574. # # no-referrer-when-downgrade (default)
  575. # # This should be the user agent's default behavior if no policy is
  576. # # specified.The origin is sent as referrer to a-priori as-much-secure
  577. # # destination (HTTPS->HTTPS), but isn't sent to a less secure destination
  578. # # (HTTPS->HTTP).
  579. # Header set Referrer-Policy "no-referrer-when-downgrade"
  580. # # `mod_headers` cannot match based on the content-type, however,
  581. # # the `Referrer-Policy` response header should be send
  582. # # only for HTML documents and not for the other resources.
  583. # <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
  584. # Header unset Referrer-Policy
  585. # </FilesMatch>
  586. # </IfModule>
  587. # ----------------------------------------------------------------------
  588. # | Server-side technology information |
  589. # ----------------------------------------------------------------------
  590. # Remove the `X-Powered-By` response header that:
  591. #
  592. # * is set by some frameworks and server-side languages
  593. # (e.g.: ASP.NET, PHP), and its value contains information
  594. # about them (e.g.: their name, version number)
  595. #
  596. # * doesn't provide any value to users, contributes to header
  597. # bloat, and in some cases, the information it provides can
  598. # expose vulnerabilities
  599. #
  600. # (!) If you can, you should disable the `X-Powered-By` header from the
  601. # language / framework level (e.g.: for PHP, you can do that by setting
  602. # `expose_php = off` in `php.ini`)
  603. #
  604. # https://php.net/manual/en/ini.core.php#ini.expose-php
  605. <IfModule mod_headers.c>
  606. Header unset X-Powered-By
  607. </IfModule>
  608. # ----------------------------------------------------------------------
  609. # | Server software information |
  610. # ----------------------------------------------------------------------
  611. # Prevent Apache from adding a trailing footer line containing
  612. # information about the server to the server-generated documents
  613. # (e.g.: error messages, directory listings, etc.)
  614. #
  615. # https://httpd.apache.org/docs/current/mod/core.html#serversignature
  616. ServerSignature Off
  617. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  618. # Prevent Apache from sending in the `Server` response header its
  619. # exact version number, the description of the generic OS-type or
  620. # information about its compiled-in modules.
  621. #
  622. # (!) The `ServerTokens` directive will only work in the main server
  623. # configuration file, so don't try to enable it in the `.htaccess` file!
  624. #
  625. # https://httpd.apache.org/docs/current/mod/core.html#servertokens
  626. #ServerTokens Prod
  627. # ######################################################################
  628. # # WEB PERFORMANCE #
  629. # ######################################################################
  630. # ----------------------------------------------------------------------
  631. # | Compression |
  632. # ----------------------------------------------------------------------
  633. <IfModule mod_deflate.c>
  634. # Force compression for mangled `Accept-Encoding` request headers
  635. # https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html
  636. <IfModule mod_setenvif.c>
  637. <IfModule mod_headers.c>
  638. SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
  639. RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
  640. </IfModule>
  641. </IfModule>
  642. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  643. # Compress all output labeled with one of the following media types.
  644. # https://httpd.apache.org/docs/current/mod/mod_filter.html#addoutputfilterbytype
  645. <IfModule mod_filter.c>
  646. AddOutputFilterByType DEFLATE "application/atom+xml" \
  647. "application/javascript" \
  648. "application/json" \
  649. "application/ld+json" \
  650. "application/manifest+json" \
  651. "application/rdf+xml" \
  652. "application/rss+xml" \
  653. "application/schema+json" \
  654. "application/vnd.geo+json" \
  655. "application/vnd.ms-fontobject" \
  656. "application/wasm" \
  657. "application/x-font-ttf" \
  658. "application/x-javascript" \
  659. "application/x-web-app-manifest+json" \
  660. "application/xhtml+xml" \
  661. "application/xml" \
  662. "font/collection" \
  663. "font/eot" \
  664. "font/opentype" \
  665. "font/otf" \
  666. "font/ttf" \
  667. "image/bmp" \
  668. "image/svg+xml" \
  669. "image/vnd.microsoft.icon" \
  670. "image/x-icon" \
  671. "text/cache-manifest" \
  672. "text/calendar" \
  673. "text/css" \
  674. "text/html" \
  675. "text/javascript" \
  676. "text/plain" \
  677. "text/markdown" \
  678. "text/vcard" \
  679. "text/vnd.rim.location.xloc" \
  680. "text/vtt" \
  681. "text/x-component" \
  682. "text/x-cross-domain-policy" \
  683. "text/xml"
  684. </IfModule>
  685. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  686. # Map the following filename extensions to the specified
  687. # encoding type in order to make Apache serve the file types
  688. # with the appropriate `Content-Encoding` response header
  689. # (do note that this will NOT make Apache compress them!).
  690. #
  691. # If these files types would be served without an appropriate
  692. # `Content-Enable` response header, client applications (e.g.:
  693. # browsers) wouldn't know that they first need to uncompress
  694. # the response, and thus, wouldn't be able to understand the
  695. # content.
  696. #
  697. # https://httpd.apache.org/docs/current/mod/mod_mime.html#addencoding
  698. <IfModule mod_mime.c>
  699. AddEncoding gzip svgz
  700. </IfModule>
  701. </IfModule>
  702. # ----------------------------------------------------------------------
  703. # | Brotli pre-compressed content |
  704. # ----------------------------------------------------------------------
  705. # Serve brotli compressed CSS, JS, HTML, SVG, ICS and JSON files
  706. # if they exist and if the client accepts br encoding.
  707. #
  708. # (!) To make this part relevant, you need to generate encoded
  709. # files by your own. Enabling this part will not auto-generate
  710. # brotlied files.
  711. #
  712. # https://httpd.apache.org/docs/current/mod/mod_brotli.html#precompressed
  713. # <IfModule mod_headers.c>
  714. # RewriteCond %{HTTP:Accept-Encoding} br
  715. # RewriteCond %{REQUEST_FILENAME}\.br -f
  716. # RewriteRule \.(css|ics|js|json|html|svg)$ %{REQUEST_URI}.br [L]
  717. # # Prevent mod_deflate double gzip
  718. # RewriteRule \.br$ - [E=no-gzip:1]
  719. # <FilesMatch "\.br$">
  720. # <IfModule mod_mime.c>
  721. # # Serve correct content types
  722. # AddType text/css css.br
  723. # AddType text/calendar ics.br
  724. # AddType text/javascript js.br
  725. # AddType application/json json.br
  726. # AddType text/html html.br
  727. # AddType image/svg+xml svg.br
  728. # # Serve correct content charset
  729. # AddCharset utf-8 .css.br \
  730. # .ics.br \
  731. # .js.br \
  732. # .json.br
  733. # </IfModule>
  734. # # Force proxies to cache brotlied and non-brotlied files separately
  735. # Header append Vary Accept-Encoding
  736. # </FilesMatch>
  737. # # Serve correct encoding type
  738. # AddEncoding br .br
  739. # </IfModule>
  740. # ----------------------------------------------------------------------
  741. # | GZip pre-compressed content |
  742. # ----------------------------------------------------------------------
  743. # Serve gzip compressed CSS, JS, HTML, SVG, ICS and JSON files
  744. # if they exist and if the client accepts gzip encoding.
  745. #
  746. # (!) To make this part relevant, you need to generate encoded
  747. # files by your own. Enabling this part will not auto-generate
  748. # gziped files.
  749. #
  750. # https://httpd.apache.org/docs/current/mod/mod_deflate.html#precompressed
  751. #
  752. # (1)
  753. # Removing default MIME Type for .gz files allowing to add custom
  754. # sub-types.
  755. # You may prefer using less generic extensions such as .html_gz in
  756. # order to keep default behavior regarding .gz files.
  757. # https://httpd.apache.org/docs/current/mod/mod_mime.html#removetype
  758. # <IfModule mod_headers.c>
  759. # RewriteCond %{HTTP:Accept-Encoding} gzip
  760. # RewriteCond %{REQUEST_FILENAME}\.gz -f
  761. # RewriteRule \.(css|ics|js|json|html|svg)$ %{REQUEST_URI}.gz [L]
  762. # # Prevent mod_deflate double gzip
  763. # RewriteRule \.gz$ - [E=no-gzip:1]
  764. # <FilesMatch "\.gz$">
  765. # # Serve correct content types
  766. # <IfModule mod_mime.c>
  767. # # (1)
  768. # RemoveType gz
  769. # # Serve correct content types
  770. # AddType text/css css.gz
  771. # AddType text/calendar ics.gz
  772. # AddType text/javascript js.gz
  773. # AddType application/json json.gz
  774. # AddType text/html html.gz
  775. # AddType image/svg+xml svg.gz
  776. # # Serve correct content charset
  777. # AddCharset utf-8 .css.gz \
  778. # .ics.gz \
  779. # .js.gz \
  780. # .json.gz
  781. # </IfModule>
  782. # # Force proxies to cache gzipped and non-gzipped files separately
  783. # Header append Vary Accept-Encoding
  784. # </FilesMatch>
  785. # # Serve correct encoding type
  786. # AddEncoding gzip .gz
  787. # </IfModule>
  788. # ----------------------------------------------------------------------
  789. # | Content transformation |
  790. # ----------------------------------------------------------------------
  791. # Prevent intermediate caches or proxies (e.g.: such as the ones
  792. # used by mobile network providers) from modifying the website's
  793. # content.
  794. #
  795. # https://tools.ietf.org/html/rfc2616#section-14.9.5
  796. #
  797. # (!) If you are using `mod_pagespeed`, please note that setting
  798. # the `Cache-Control: no-transform` response header will prevent
  799. # `PageSpeed` from rewriting `HTML` files, and, if the
  800. # `ModPagespeedDisableRewriteOnNoTransform` directive isn't set
  801. # to `off`, also from rewriting other resources.
  802. #
  803. # https://developers.google.com/speed/pagespeed/module/configuration#notransform
  804. # <IfModule mod_headers.c>
  805. # Header merge Cache-Control "no-transform"
  806. # </IfModule>
  807. # ----------------------------------------------------------------------
  808. # | ETags |
  809. # ----------------------------------------------------------------------
  810. # Remove `ETags` as resources are sent with far-future expires headers.
  811. #
  812. # https://developer.yahoo.com/performance/rules.html#etags
  813. # https://tools.ietf.org/html/rfc7232#section-2.3
  814. # `FileETag None` doesn't work in all cases.
  815. <IfModule mod_headers.c>
  816. Header unset ETag
  817. </IfModule>
  818. FileETag None
  819. # ----------------------------------------------------------------------
  820. # | Expires headers |
  821. # ----------------------------------------------------------------------
  822. # Serve resources with far-future expires headers.
  823. #
  824. # (!) If you don't control versioning with filename-based
  825. # cache busting, you should consider lowering the cache times
  826. # to something like one week.
  827. #
  828. # https://httpd.apache.org/docs/current/mod/mod_expires.html
  829. <IfModule mod_expires.c>
  830. ExpiresActive on
  831. ExpiresDefault "access plus 1 month"
  832. # CSS
  833. ExpiresByType text/css "access plus 1 year"
  834. # Data interchange
  835. ExpiresByType application/atom+xml "access plus 1 hour"
  836. ExpiresByType application/rdf+xml "access plus 1 hour"
  837. ExpiresByType application/rss+xml "access plus 1 hour"
  838. ExpiresByType application/json "access plus 0 seconds"
  839. ExpiresByType application/ld+json "access plus 0 seconds"
  840. ExpiresByType application/schema+json "access plus 0 seconds"
  841. ExpiresByType application/vnd.geo+json "access plus 0 seconds"
  842. ExpiresByType application/xml "access plus 0 seconds"
  843. ExpiresByType text/calendar "access plus 0 seconds"
  844. ExpiresByType text/xml "access plus 0 seconds"
  845. # Favicon (cannot be renamed!) and cursor images
  846. ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
  847. ExpiresByType image/x-icon "access plus 1 week"
  848. # HTML
  849. ExpiresByType text/html "access plus 0 seconds"
  850. # JavaScript
  851. ExpiresByType application/javascript "access plus 1 year"
  852. ExpiresByType application/x-javascript "access plus 1 year"
  853. ExpiresByType text/javascript "access plus 1 year"
  854. # Manifest files
  855. ExpiresByType application/manifest+json "access plus 1 week"
  856. ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
  857. ExpiresByType text/cache-manifest "access plus 0 seconds"
  858. # Markdown
  859. ExpiresByType text/markdown "access plus 0 seconds"
  860. # Media files
  861. ExpiresByType audio/ogg "access plus 1 month"
  862. ExpiresByType image/bmp "access plus 1 month"
  863. ExpiresByType image/gif "access plus 1 month"
  864. ExpiresByType image/jpeg "access plus 1 month"
  865. ExpiresByType image/png "access plus 1 month"
  866. ExpiresByType image/svg+xml "access plus 1 month"
  867. ExpiresByType image/webp "access plus 1 month"
  868. ExpiresByType video/mp4 "access plus 1 month"
  869. ExpiresByType video/ogg "access plus 1 month"
  870. ExpiresByType video/webm "access plus 1 month"
  871. # WebAssembly
  872. ExpiresByType application/wasm "access plus 1 year"
  873. # Web fonts
  874. # Collection
  875. ExpiresByType font/collection "access plus 1 month"
  876. # Embedded OpenType (EOT)
  877. ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
  878. ExpiresByType font/eot "access plus 1 month"
  879. # OpenType
  880. ExpiresByType font/opentype "access plus 1 month"
  881. ExpiresByType font/otf "access plus 1 month"
  882. # TrueType
  883. ExpiresByType application/x-font-ttf "access plus 1 month"
  884. ExpiresByType font/ttf "access plus 1 month"
  885. # Web Open Font Format (WOFF) 1.0
  886. ExpiresByType application/font-woff "access plus 1 month"
  887. ExpiresByType application/x-font-woff "access plus 1 month"
  888. ExpiresByType font/woff "access plus 1 month"
  889. # Web Open Font Format (WOFF) 2.0
  890. ExpiresByType application/font-woff2 "access plus 1 month"
  891. ExpiresByType font/woff2 "access plus 1 month"
  892. # Other
  893. ExpiresByType text/x-cross-domain-policy "access plus 1 week"
  894. </IfModule>
  895. # ----------------------------------------------------------------------
  896. # | File concatenation |
  897. # ----------------------------------------------------------------------
  898. # Allow concatenation from within specific files.
  899. #
  900. # e.g.:
  901. #
  902. # If you have the following lines in a file called, for
  903. # example, `main.combined.js`:
  904. #
  905. # <!--#include file="js/jquery.js" -->
  906. # <!--#include file="js/jquery.timer.js" -->
  907. #
  908. # Apache will replace those lines with the content of the
  909. # specified files.
  910. # <IfModule mod_include.c>
  911. # <FilesMatch "\.combined\.js$">
  912. # Options +Includes
  913. # AddOutputFilterByType INCLUDES application/javascript \
  914. # application/x-javascript \
  915. # text/javascript
  916. # SetOutputFilter INCLUDES
  917. # </FilesMatch>
  918. # <FilesMatch "\.combined\.css$">
  919. # Options +Includes
  920. # AddOutputFilterByType INCLUDES text/css
  921. # SetOutputFilter INCLUDES
  922. # </FilesMatch>
  923. # </IfModule>
  924. # ----------------------------------------------------------------------
  925. # | Filename-based cache busting |
  926. # ----------------------------------------------------------------------
  927. # If you're not using a build process to manage your filename version
  928. # revving, you might want to consider enabling the following directives
  929. # to route all requests such as `/style.12345.css` to `/style.css`.
  930. #
  931. # To understand why this is important and even a better solution than
  932. # using something like `*.css?v231`, please see:
  933. # http://www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/
  934. # <IfModule mod_rewrite.c>
  935. # RewriteEngine On
  936. # RewriteCond %{REQUEST_FILENAME} !-f
  937. # RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|m?js|png|svgz?|webp|webmanifest)$ $1.$3 [L]
  938. # </IfModule>