53 lines
3.1 KiB
ApacheConf
53 lines
3.1 KiB
ApacheConf
# ── HTTPS Redirect ──────────────────────────────────────────────────────────
|
|
RewriteEngine On
|
|
RewriteCond %{HTTPS} off
|
|
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
|
|
|
|
# ── Security Headers ─────────────────────────────────────────────────────────
|
|
# HSTS: tell browsers to always use HTTPS (1 year). Add "; preload" and submit
|
|
# to https://hstspreload.org once you're confident HTTPS is permanent.
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
|
|
# Prevent MIME-type sniffing
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
|
|
# Block this site from being embedded in iframes
|
|
Header always set X-Frame-Options "DENY"
|
|
|
|
# Control how much referrer info is sent to external sites
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
|
|
# Disable browser features not used by this site
|
|
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()"
|
|
|
|
# Prevent cross-origin window attacks
|
|
Header always set Cross-Origin-Opener-Policy "same-origin"
|
|
|
|
# Restrict cross-origin resource loading
|
|
Header always set Cross-Origin-Resource-Policy "same-origin"
|
|
|
|
# Content Security Policy
|
|
# - script/style 'unsafe-inline' required for inline blocks in both pages
|
|
# - fonts.googleapis.com for Google Fonts CSS; fonts.gstatic.com for font files
|
|
# - ki5bhv.com for the profile photo
|
|
Header always set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests"
|
|
|
|
# ── Strip Server Info ─────────────────────────────────────────────────────────
|
|
Header always unset X-Powered-By
|
|
Header always unset Server
|
|
|
|
# ── security.txt: also serve from /.well-known/ per RFC 9116 ─────────────────
|
|
RedirectMatch 301 ^/.well-known/security.txt$ /security.txt
|
|
|
|
# ── Sitemap ───────────────────────────────────────────────────────────────────
|
|
# Declared here so crawlers that read robots.txt can find it
|
|
# (also declared in robots.txt if you add one)
|
|
|
|
# ── Disable directory listing ─────────────────────────────────────────────────
|
|
Options -Indexes
|
|
|
|
# ── Protect dotfiles ──────────────────────────────────────────────────────────
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|