This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything in it seems to be ok, My hosting company helped me set up alot of these rules, While others where taken from various different blog posts. I'm looking to get feedback or reviews to see whether it is correct or whether it can be improved as I am still learning I don't expect it to be 100% acurate.

Some of the comments are just for my own understanding and learning purposes. Is anything missing or incorrect? Should everything be inside an IfModule?

    <IfModule mod_deflate.c>
                  SetOutputFilter DEFLATE
    <IfModule mod_setenvif.c>
           # Netscape 4.x has some problems...
              BrowserMatch ^Mozilla/4 gzip-only-text/html
           # Netscape 4.06-4.08 have some more problems
              BrowserMatch ^Mozilla/4\.0[678] no-gzip
              BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
           # MSIE masquerades as Netscape, but it is fine
           # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

           # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
           # the above regex won't work. You can use the following
           # workaround to get the desired effect:

           # Don't compress images
             SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary

    <IfModule mod_headers.c>
           # Make sure proxies don't deliver the wrong content
        Header always set Content-Security-Policy: upgrade-insecure-requests 
        Header set Strict-Transport-Security "max-age=122112887284; includeSubDomains; preload"
        Header append Vary User-Agent env=!dont-vary
        Header always append X-Frame-Options SAMEORIGIN
        Header set X-XSS-Protection "1; mode=block"
        Header set X-Content-Type-Options nosniff
        Header set Access-Control-Allow-Origin "*"
         IndexIgnore *.zip *.css *.php *.js *.pyt    
         Options -MultiViews -Indexes        


    # I'm guessing the code I added below reffers to cache storage either locally or on host/server Please check this.
    # Haven't set up any rules for Cache storage yet Add this... 

    <IfModule mod_expires.c>
       ExpiresActive On
       ExpiresDefault "access plus 6 hours"        
       ExpiresByType image/jpg "access plus 1 year"
       ExpiresByType image/jpeg "access plus 1 year"
       ExpiresByType image/gif "access plus 1 year"
       ExpiresByType image/png "access plus 1 year"
       ExpiresByType image/svg "access plus 1 year"
       ExpiresByType image/ani "access plus 1 year"
       ExpiresByType image/cur "access plus 1 year"
       ExpiresByType text/css "access plus 6 months"
       ExpiresByType image/html "access plus 4 hours"
       ExpiresByType image/x-icon "access plus 2 year"
       ExpiresByType application/pdf "access plus 2 months"
       ExpiresByType text/javascript "access plus 2 hours"
        # Added from :: https://www.youtube.com/watch?v=FEflwAIlLmg
        # Loading Ok with the Above code............ 

    # Prevent viewing of .htaccess file Same source as above

    #   <Files .htaccess>                   This part is throwing a server error... 
    #       order allow, deny
    #       deny from all
    #   </Files>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.