177 lines
6.1 KiB
ApacheConf
177 lines
6.1 KiB
ApacheConf
# protection contre la lecture des répertoires
|
|
Options All -Indexes
|
|
|
|
# Masquer les informations du serveur
|
|
ServerSignature Off
|
|
|
|
RewriteEngine on
|
|
|
|
# Protect wp-config.php
|
|
<FilesMatch ^wp-config.php$>
|
|
deny from all
|
|
</FilesMatch>
|
|
|
|
# Protect .htaccess et .htpasswds
|
|
<Files ~ "^.*\.([Hh][Tt][AaPp])">
|
|
order allow,deny
|
|
deny from all
|
|
</Files>
|
|
|
|
# Protect debug.log
|
|
<Files debug.log>
|
|
order allow,deny
|
|
deny from all
|
|
</Files>
|
|
|
|
# Protect sql files
|
|
<FilesMatch "\.sql">
|
|
Order allow,deny
|
|
Deny from all
|
|
</FilesMatch>
|
|
|
|
# protection des fichiers readme et licence wordpress
|
|
<files readme.html>
|
|
Order allow,deny
|
|
Deny from all
|
|
</files>
|
|
<files license.txt>
|
|
Order allow,deny
|
|
Deny from all
|
|
</files>
|
|
<files readme.txt>
|
|
Order allow,deny
|
|
Deny from all
|
|
</files>
|
|
|
|
# protection des fichiers sys
|
|
RedirectMatch 404 /\.
|
|
|
|
#Bloquer l'indexation des fichiers PDF
|
|
<Files ~ "\.(doc|docx|pdf)$">
|
|
Header set X-Robots-Tag "noindex, nofollow"
|
|
</Files>
|
|
|
|
# Cacher l'identifiant d'un auteur
|
|
<IfModule mod_rewrite.c>
|
|
RewriteCond %{QUERY_STRING} ^author=([0-9]*)
|
|
RewriteRule .* - [F]
|
|
</IfModule>
|
|
|
|
### FILTRE CONTRE XSS, REDIRECTIONS HTTP, base64_encode, VARIABLE PHP GLOBALS VIA URL, MODIFIER VARIABLE _REQUEST VIA URL, TEST DE FAILLE PHP, INJECTION SQL SIMPLE
|
|
RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)(https?|ftp|mosConfig)(%3A|:)//(.*)$ [NC,OR] ## ATTENTION A CETTE REGLE. ELLE PEUT CASSER CERTAINES REDIRECTIONS RESSEMBLANT A: http://www.truc.fr/index.php?r=http://www.google.fr ##
|
|
RewriteCond %{QUERY_STRING} ^.*(_encode|localhost|loopback).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(SELECT(%20|\+)|UNION(%20|\+)ALL|INSERT(%20|\+)|DELETE(%20|\+)|CHAR\(|UPDATE(%20|\+)|REPLACE(%20|\+)|LIMIT(%20|\+)|CONCAT(%20|\+)|DECLARE(%20|\+))(.*)$ [NC]
|
|
RewriteRule (.*) - [F]
|
|
|
|
# BEGIN DEFLATE COMPRESSION
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE application/javascript
|
|
AddOutputFilterByType DEFLATE application/rss+xml
|
|
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
|
|
AddOutputFilterByType DEFLATE application/x-font
|
|
AddOutputFilterByType DEFLATE application/x-font-opentype
|
|
AddOutputFilterByType DEFLATE application/x-font-otf
|
|
AddOutputFilterByType DEFLATE application/x-font-truetype
|
|
AddOutputFilterByType DEFLATE application/x-font-ttf
|
|
AddOutputFilterByType DEFLATE application/x-javascript
|
|
AddOutputFilterByType DEFLATE application/xhtml+xml
|
|
AddOutputFilterByType DEFLATE application/xml
|
|
AddOutputFilterByType DEFLATE font/opentype
|
|
AddOutputFilterByType DEFLATE font/otf
|
|
AddOutputFilterByType DEFLATE font/ttf
|
|
AddOutputFilterByType DEFLATE image/svg+xml
|
|
AddOutputFilterByType DEFLATE image/x-icon
|
|
AddOutputFilterByType DEFLATE text/css
|
|
AddOutputFilterByType DEFLATE text/html
|
|
AddOutputFilterByType DEFLATE text/javascript
|
|
AddOutputFilterByType DEFLATE text/plain
|
|
AddOutputFilterByType DEFLATE text/xml
|
|
</IfModule>
|
|
# END DEFLATE COMPRESSION
|
|
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresDefault "access plus 1 month"
|
|
ExpiresByType text/html "access plus 0 seconds"
|
|
ExpiresByType text/xml "access plus 0 seconds"
|
|
ExpiresByType application/xml "access plus 0 seconds"
|
|
ExpiresByType application/json "access plus 0 seconds"
|
|
ExpiresByType application/pdf "access plus 0 seconds"
|
|
ExpiresByType application/rss+xml "access plus 1 hour"
|
|
ExpiresByType application/atom+xml "access plus 1 hour"
|
|
ExpiresByType application/x-font-ttf "access plus 1 month"
|
|
ExpiresByType font/opentype "access plus 1 month"
|
|
ExpiresByType application/x-font-woff "access plus 1 month"
|
|
ExpiresByType application/x-font-woff2 "access plus 1 month"
|
|
ExpiresByType image/svg+xml "access plus 1 month"
|
|
ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
|
|
ExpiresByType image/jpg "access plus 1 month"
|
|
ExpiresByType image/jpeg "access plus 1 month"
|
|
ExpiresByType image/gif "access plus 1 month"
|
|
ExpiresByType image/png "access plus 1 month"
|
|
ExpiresByType video/ogg "access plus 1 month"
|
|
ExpiresByType audio/ogg "access plus 1 month"
|
|
ExpiresByType video/mp4 "access plus 1 month"
|
|
ExpiresByType video/webm "access plus 1 month"
|
|
ExpiresByType text/css "access plus 6 month"
|
|
ExpiresByType application/javascript "access plus 6 month"
|
|
ExpiresByType application/x-shockwave-flash "access plus 1 week"
|
|
ExpiresByType image/x-icon "access plus 1 week"
|
|
</IfModule>
|
|
|
|
<IfModule mod_headers.c>
|
|
<FilesMatch "\\.(ico|jpe?g|png|gif|swf|svg)$">
|
|
Header set Cache-Control "max-age=2592000, public"
|
|
</FilesMatch>
|
|
<FilesMatch "\\.(css)$">
|
|
Header set Cache-Control "max-age=604800, public"
|
|
</FilesMatch>
|
|
<FilesMatch "\\.(js)$">
|
|
Header set Cache-Control "max-age=604800, private"
|
|
</FilesMatch>
|
|
<filesmatch "\\.(html|htm)$">
|
|
Header set Cache-Control "max-age=5, public"
|
|
</filesmatch>
|
|
<filesmatch "\\.(woff)$">
|
|
Header set Cache-Control "max-age=604800, public"
|
|
</filesmatch>
|
|
</IfModule>
|
|
|
|
|
|
<ifModule mod_gzip.c>
|
|
mod_gzip_on Yes
|
|
mod_gzip_dechunk Yes
|
|
mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
|
|
mod_gzip_item_include handler ^cgi-script$
|
|
mod_gzip_item_include mime ^text/.*
|
|
mod_gzip_item_include mime ^application/x-javascript.*
|
|
mod_gzip_item_exclude mime ^image/.*
|
|
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
|
|
</ifModule>
|
|
|
|
Header unset Pragma
|
|
FileETag None
|
|
Header unset ETag
|
|
|
|
# BEGIN WordPress
|
|
# Les directives (lignes) entre 'BEGIN WordPress' et 'END WordPress' sont
|
|
# généré dynamiquement, et ne doivent uniquement être modifiées via les filtres WordPress.
|
|
# Toute modification des directives entre ces marqueurs sera outrepassée.
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine On
|
|
RewriteBase /
|
|
RewriteRule ^index\.php$ - [L]
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule . /index.php [L]
|
|
</IfModule>
|
|
|
|
# END WordPress
|