# protection contre la lecture des répertoires
Options All -Indexes

# Masquer les informations du serveur
ServerSignature Off


# Protect .htaccess et .htpasswds
<Files ~ "^.*\.([Hh][Tt][AaPp])">
   order allow,deny
   deny from all
</Files>

# Protect sql files
<FilesMatch "\.sql">
	Order allow,deny
	Deny from all
</FilesMatch>


<IfModule mod_mime.c>
    AddType application/vnd.ms-fontobject    .eot
    AddType application/x-font-opentype      .otf
    AddType image/svg+xml                    .svg
    AddType application/x-font-ttf           .ttf
    AddType application/font-woff            .woff
    AddType application/font-woff2           .woff2
</IfModule>


### FILTRE CONTRE XSS, REDIRECTIONS HTTP, base64_encode, VARIABLE PHP GLOBALS VIA URL, MODIFIER VARIABLE _REQUEST VIA URL, TEST DE FAILLE PHP, INJECTION SQL SIMPLE
	RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
	RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR]
	RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
	RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
	RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)(https?|ftp|mosConfig)(%3A|:)//(.*)$ [NC,OR] ## ATTENTION A CETTE REGLE. ELLE PEUT CASSER CERTAINES REDIRECTIONS RESSEMBLANT A: http://www.truc.fr/index.php?r=http://www.google.fr ##
	RewriteCond %{QUERY_STRING} ^.*(_encode|localhost|loopback).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
	RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
	RewriteCond %{QUERY_STRING} ^(.*)(SELECT(%20|\+)|UNION(%20|\+)ALL|INSERT(%20|\+)|DELETE(%20|\+)|CHAR\(|UPDATE(%20|\+)|REPLACE(%20|\+)|LIMIT(%20|\+)|CONCAT(%20|\+)|DECLARE(%20|\+))(.*)$ [NC]
	RewriteRule (.*) - [F]



<IfModule mod_headers.c>
	# A TESTER la page n'accepte que les scripts provenant du même nom de domaine et de google.com (par exemple)
	#Header set Content-Security-Policy "script-src 'self' https://www.google.com"

	# Protection contre le clickjacking. Interdit que le site soit intégré en iframe
	Header always set X-FRAME-OPTIONS "SAMEORIGIN"

	# Bloque la totalité du contenu lorsqu'une attaque XSS est suspectée
	Header always set X-XSS-Protection "1; mode=block"

	#Désactive la détection automatique du type des ressources
	Header always set X-Content-Type-Options "nosniff"

	# protege les cookies d'être modifiés par le client
	Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
</IfModule>

# BEGIN DEFLATE COMPRESSION
<IfModule mod_deflate.c>
	AddOutputFilterByType DEFLATE application/javascript
	AddOutputFilterByType DEFLATE application/rss+xml
	AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
	AddOutputFilterByType DEFLATE application/x-font
	AddOutputFilterByType DEFLATE application/x-font-opentype
	AddOutputFilterByType DEFLATE application/x-font-otf
	AddOutputFilterByType DEFLATE application/x-font-truetype
	AddOutputFilterByType DEFLATE application/x-font-ttf
	AddOutputFilterByType DEFLATE application/font-woff2
	AddOutputFilterByType DEFLATE application/x-javascript
	AddOutputFilterByType DEFLATE application/xhtml+xml
	AddOutputFilterByType DEFLATE application/xml
	AddOutputFilterByType DEFLATE font/opentype
	AddOutputFilterByType DEFLATE font/otf
	AddOutputFilterByType DEFLATE font/ttf
	AddOutputFilterByType DEFLATE image/svg+xml
	AddOutputFilterByType DEFLATE image/x-icon
	AddOutputFilterByType DEFLATE text/css
	AddOutputFilterByType DEFLATE text/html
	AddOutputFilterByType DEFLATE text/javascript
	AddOutputFilterByType DEFLATE text/plain
	AddOutputFilterByType DEFLATE text/xml
</IfModule>
# END DEFLATE COMPRESSION

<IfModule mod_expires.c>
	ExpiresActive On
	ExpiresDefault "access plus 1 month"
	ExpiresByType text/html "access plus 0 seconds"
	ExpiresByType text/xml "access plus 0 seconds"
	ExpiresByType application/xml "access plus 0 seconds"
	ExpiresByType application/json "access plus 0 seconds"
	ExpiresByType application/pdf "access plus 0 seconds"
	ExpiresByType application/rss+xml "access plus 1 hour"
	ExpiresByType application/atom+xml "access plus 1 hour"
	ExpiresByType application/x-font-ttf "access plus 1 month"
	ExpiresByType font/opentype "access plus 1 month"
	ExpiresByType application/x-font-woff "access plus 1 month"
	ExpiresByType application/x-font-woff2 "access plus 1 month"
	ExpiresByType image/svg+xml "access plus 1 month"
	ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
	ExpiresByType image/jpg "access plus 1 month"
	ExpiresByType image/jpeg "access plus 1 month"
	ExpiresByType image/gif "access plus 1 month"
	ExpiresByType image/png "access plus 1 month"
	ExpiresByType video/ogg "access plus 1 month"
	ExpiresByType audio/ogg "access plus 1 month"
	ExpiresByType video/mp4 "access plus 1 month"
	ExpiresByType video/webm "access plus 1 month"
	ExpiresByType text/css "access plus 6 month"
	ExpiresByType application/javascript "access plus 6 month"
	ExpiresByType application/x-shockwave-flash "access plus 1 week"
	ExpiresByType image/x-icon "access plus 1 week"
</IfModule>

<IfModule mod_headers.c>
    <FilesMatch "\\.(ico|jpe?g|png|gif|swf|svg)$">
        Header set Cache-Control "max-age=2592000, public"
    </FilesMatch>
    <FilesMatch "\\.(css)$">
        Header set Cache-Control "max-age=604800, public"
    </FilesMatch>
    <FilesMatch "\\.(js)$">
        Header set Cache-Control "max-age=604800, private"
    </FilesMatch>
    <filesmatch "\\.(html|htm)$">
        Header set Cache-Control "max-age=5, public"
    </filesmatch>
    <filesmatch "\\.(woff)$">
        Header set Cache-Control "max-age=604800, public"
    </filesmatch>
</IfModule>


<ifModule mod_gzip.c>
	mod_gzip_on Yes
	mod_gzip_dechunk Yes
	mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
	mod_gzip_item_include handler ^cgi-script$
	mod_gzip_item_include mime ^text/.*
	mod_gzip_item_include mime ^application/x-javascript.*
	mod_gzip_item_exclude mime ^image/.*
	mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>

Header unset Pragma
FileETag None
Header unset ETag


<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>
