AddDefaultCharset UTF-8
<IfModule mod_mime.c>
  AddCharset UTF-8 .html .htm .css .js .json .xml
</IfModule>

Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule (^|/)\.(?!well-known/) - [F,L]
    RewriteRule ^(?:config|includes|scripts|storage|tests|migrations|seeds|deployment|docs|vendor|database|samples|qa)(?:/|$) - [F,L,NC]
    RewriteRule \.(?:sql|log|ini|env|bak|dist|md|lock|json|zip|7z|rar|tar|gz)$ - [F,L,NC]
    RewriteRule ^composer\.(?:json|lock)$ - [F,L,NC]
</IfModule>

<FilesMatch "(?i)\.(sql|log|ini|env|bak|dist|md|lock|json|zip|7z|rar|tar|gz)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self'; media-src 'self' blob:; worker-src 'self' blob:"
    Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"
</IfModule>


<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/jpeg "access plus 30 days"
  ExpiresByType image/webp "access plus 30 days"
  ExpiresByType image/svg+xml "access plus 30 days"
</IfModule>
<IfModule mod_headers.c>
  <FilesMatch "\.(?:css|js|png|jpe?g|webp|svg)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
</IfModule>
