.htaccess

##
## Disable directory listings
##
<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>


##
## Deny access to system files
##
<FilesMatch "((\.(lock|cache|db))|\.gitignore|installed\.json|composer\.json|package\.json|bower\.json|CHANGELOG\.md|README\.md|gulpfile\.js|webpack\.config\.js)$">
    Order allow,deny
    Deny from all
</FilesMatch>


##
## Allow access from all domains for webfonts
##
<IfModule mod_headers.c>
    <FilesMatch "\.(ttf|ttc|otf|eot|woff2?|font\.css)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>


##
## Disable ETags
##
FileETag None
<IfModule mod_headers.c>
    Header unset ETag
</IfModule>


##
## Some security settings
##
<IfModule mod_headers.c>

    ## Reduce MIME type security risks
    Header set X-Content-Type-Options "nosniff"

    ## Hide server-side technology information
    Header unset X-Powered-By

</IfModule>


##
## Seting proper MIME types
##
<IfModule mod_mime.c>

    ## Data interchange
    AddType application/atom+xml                        atom
    AddType application/json                            json map topojson
    AddType application/ld+json                         jsonld
    AddType application/rss+xml                         rss
    AddType application/vnd.geo+json                    geojson
    AddType application/xml                             rdf xml

    ## JavaScript
    AddType application/javascript                      js

    ## Manifest files
    AddType application/manifest+json                   webmanifest
    AddType application/x-web-app-manifest+json         webapp
    AddType text/cache-manifest                         appcache

    ## Media files
    AddType audio/mp4                                   f4a f4b m4a
    AddType audio/ogg                                   oga ogg opus
    AddType image/bmp                                   bmp
    AddType image/svg+xml                               svg svgz
    AddType image/webp                                  webp
    AddType image/x-icon                                cur ico
    AddType video/mp4                                   f4v f4p m4v mp4
    AddType video/ogg                                   ogv
    AddType video/webm                                  webm
    AddType video/x-flv                                 flv

    ## Web fonts
    AddType application/font-woff                       woff
    AddType application/font-woff2                      woff2
    AddType application/vnd.ms-fontobject               eot
    AddType application/x-font-ttf                      ttc ttf
    AddType font/opentype                               otf

    ## Other
    AddType application/octet-stream                    safariextz
    AddType application/x-bb-appworld                   bbaw
    AddType application/x-chrome-extension              crx
    AddType application/x-opera-extension               oex
    AddType application/x-xpinstall                     xpi
    AddType text/vcard                                  vcard vcf
    AddType text/vnd.rim.location.xloc                  xloc
    AddType text/vtt                                    vtt
    AddType text/x-component                            htc

</IfModule>


##
# Gzip compression
##
<IfModule mod_deflate.c>

    ## Force compression for mangled `Accept-Encoding` request headers
    ## https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html
    <IfModule mod_setenvif.c>
        <IfModule mod_headers.c>
            SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
            RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
        </IfModule>
    </IfModule>

    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE "application/atom+xml" \
                                      "application/javascript" \
                                      "application/json" \
                                      "application/ld+json" \
                                      "application/manifest+json" \
                                      "application/rdf+xml" \
                                      "application/rss+xml" \
                                      "application/schema+json" \
                                      "application/vnd.geo+json" \
                                      "application/vnd.ms-fontobject" \
                                      "application/x-font-ttf" \
                                      "application/x-javascript" \
                                      "application/x-web-app-manifest+json" \
                                      "application/xhtml+xml" \
                                      "application/xml" \
                                      "font/eot" \
                                      "font/opentype" \
                                      "image/bmp" \
                                      "image/svg+xml" \
                                      "image/vnd.microsoft.icon" \
                                      "image/x-icon" \
                                      "text/cache-manifest" \
                                      "text/css" \
                                      "text/html" \
                                      "text/javascript" \
                                      "text/plain" \
                                      "text/vcard" \
                                      "text/vnd.rim.location.xloc" \
                                      "text/vtt" \
                                      "text/x-component" \
                                      "text/x-cross-domain-policy" \
                                      "text/xml"
    </IfModule>

    <IfModule mod_mime.c>
        AddEncoding gzip              svgz
    </IfModule>

</IfModule>


##
## Expires headers (for better cache control)
##
<IfModule mod_expires.c>

    ExpiresActive on
    ExpiresDefault                                      "access plus 1 month"

    ## Data interchange
    ExpiresByType application/atom+xml                  "access plus 1 hour"
    ExpiresByType application/rdf+xml                   "access plus 1 hour"
    ExpiresByType application/rss+xml                   "access plus 1 hour"

    ExpiresByType application/json                      "access plus 0 seconds"
    ExpiresByType application/ld+json                   "access plus 0 seconds"
    ExpiresByType application/schema+json               "access plus 0 seconds"
    ExpiresByType application/vnd.geo+json              "access plus 0 seconds"
    ExpiresByType application/xml                       "access plus 0 seconds"
    ExpiresByType text/xml                              "access plus 0 seconds"

    ## Favicon (cannot be renamed!) and cursor images
    ExpiresByType image/vnd.microsoft.icon              "access plus 1 week"
    ExpiresByType image/x-icon                          "access plus 1 week"

    ## HTML
    ExpiresByType text/html                             "access plus 0 seconds"

    ## JavaScript and CSS
    ExpiresByType application/javascript                "access plus 1 year"
    ExpiresByType application/x-javascript              "access plus 1 year"
    ExpiresByType text/javascript                       "access plus 1 year"
    ExpiresByType text/css                              "access plus 1 year"

    ## Manifest files
    ExpiresByType application/manifest+json             "access plus 1 week"
    ExpiresByType application/x-web-app-manifest+json   "access plus 0 seconds"
    ExpiresByType text/cache-manifest                   "access plus 0 seconds"

    ## Media files
    ExpiresByType audio/ogg                             "access plus 1 month"
    ExpiresByType image/bmp                             "access plus 1 month"
    ExpiresByType image/gif                             "access plus 1 month"
    ExpiresByType image/jpeg                            "access plus 1 month"
    ExpiresByType image/png                             "access plus 1 month"
    ExpiresByType image/svg+xml                         "access plus 1 month"
    ExpiresByType image/webp                            "access plus 1 month"
    ExpiresByType video/mp4                             "access plus 1 month"
    ExpiresByType video/ogg                             "access plus 1 month"
    ExpiresByType video/webm                            "access plus 1 month"

    ## Web fonts
    ExpiresByType application/vnd.ms-fontobject         "access plus 1 year"
    ExpiresByType font/eot                              "access plus 1 year"
    ExpiresByType font/opentype                         "access plus 1 year"
    ExpiresByType application/x-font-ttf                "access plus 1 year"
    ExpiresByType application/font-woff                 "access plus 1 year"
    ExpiresByType application/x-font-woff               "access plus 1 year"
    ExpiresByType font/woff                             "access plus 1 year"
    ExpiresByType application/font-woff2                "access plus 1 year"

    ## Other
    ExpiresByType text/x-cross-domain-policy            "access plus 1 week"

</IfModule>



################################

##
# Prevent access to the Contao template files
# TODO: remove this in future
##
<FilesMatch "\.(tpl|html5)$">
  <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
  </IfModule>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>


##
# Header adjustments
# TODO: remove this in future
##
<IfModule mod_headers.c>

  ##
  # Disable caching during development
  # @see https://github.com/contao/core/issues/4364
  ##
  #Header unset Cache-Control
  #Header append Cache-Control must-revalidate

  ##
  # Do not cache the cron.txt file
  # @see https://github.com/contao/core/issues/5105
  ##
  <FilesMatch "cron\.txt$">
    Header set Cache-Control "no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform"
  </FilesMatch>

  ##
  # Add a Vary Accept-Encoding header for the compressed resources. If you
  # modify the file types above, make sure to change them here accordingly.
  # @see http://developer.yahoo.com/performance/rules.html#gzip
  #
  # Note: If you are using a case-sensitive file system like HFS+ or ext4, you
  # have to change the <FilesMatch> directive as follows:
  #
  # <FilesMatch "\.(?i:js|css|xml|gz|svgz)$">
  #
  # For more information see: https://github.com/contao/core/issues/4364
  ##
  <FilesMatch "\.(js|css|xml|gz|svgz)$">
    Header append Vary Accept-Encoding
  </FilesMatch>

</IfModule>


##
# URL rewriting
##
<IfModule mod_rewrite.c>

  Options -MultiViews

  RewriteEngine On

  ##
  # Change the RewriteBase if your Contao installation is in a subdirectoy and
  # the rewrite rules are not working properly. Usage examples:
  #
  #   RewriteBase /contao-3.0.0
  #   RewriteBase /path/to/contao
  #
  # Depending on your server, you might have to remove the line entirely.
  ##
  RewriteBase /

  ##
  # Uncomment the following lines to add "www." to the domain:
  #
  #   RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
  #   RewriteRule (.*) http://www.example.com/$1 [R=301,L]
  #
  # Uncomment the following lines to remove "www." from the domain:
  #
  #   RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
  #   RewriteRule (.*) http://example.com/$1 [R=301,L]
  #
  # Make sure to replace "example.com" with your domain name.
  ##
#  RewriteCond %{HTTP_HOST} ^www\.(.*)$
#  RewriteRule ^(.*)$ https://%1/$1 [L,R=301]

#  RewriteCond %{HTTPS} off
#  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  RewriteCond %{REQUEST_FILENAME} !\.(htm|html|php|js|css|map|htc|png|gif|jpe?g|ico|xml|csv|txt|swf|flv|mp4|webm|ogv|mp3|ogg|oga|eot|otf|tt[cf]|woff2?|svgz?|pdf|zip|gz)$
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule .* index.php [L]

  ##
  # The following rules are required if you want to pass the language as first
  # URL parameter (added in Contao 2.11). The first rule rewrites the empty URL
  # to the front end controller, the second one adds a missing trailing slash.
  ##
  RewriteRule ^[a-z]{2}(\-[A-Z]{2})?/$ index.php [L]
  RewriteRule ^([a-z]{2}(\-[A-Z]{2})?)$ $1/ [R=301,L]

</IfModule>




##
## URL rewriting
## TODO: Take this rewrites as default in future
##
#<IfModule mod_rewrite.c>
#
#    Options -MultiViews
#
#    RewriteEngine On
#
#    ##
#    ## You may need to uncomment the following line for some hosting environments.
#    ## Or change the RewriteBase if your Grow installation is in a subdirectoy.
#    ## Usage example:
#    ##
#    ##   RewriteBase /path/to/grow
#    ##
#    # RewriteBase /
#
#
#    ##
#    ## Uncomment the following lines to add "www." to the domain
#    ## Make sure to replace "example.com" with your domain name.
#    ##
#    # RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
#    # RewriteRule (.*) http://www.example.com/$1 [R=301,L]
#
#    ##
#    ## Uncomment the following lines to remove "www." from the domain
#    ##
#    # RewriteCond %{HTTPS} !=on
#    # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
#    # RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
#
#
#    ##
#    ## Deny access to system folders
#    ##
#    RewriteRule ^vendor/.* index.php [L,NC]
#
#
#    ##
#    ## Block all PHP files, except index
#    ##
#    RewriteCond %{REQUEST_FILENAME} -f
#    RewriteCond %{REQUEST_FILENAME} \.php$
#    RewriteRule !^index.php index.php [L,NC]
#
#
#    ##
#    ## Standard routes
#    ##
#    RewriteCond %{REQUEST_FILENAME} !-f
#    RewriteCond %{REQUEST_FILENAME} !-d
#    RewriteRule .* index.php [L]
#
#
#</IfModule>