From d4684df905fd5d616b75dcbe7ffbcc2d011bae2d Mon Sep 17 00:00:00 2001 From: xhmikosr Date: Wed, 3 Jul 2013 05:41:44 +0000 Subject: [PATCH] Update .htaccess to the latest html5 boilerplate keeping our custom code. git-svn-id: svn://svn.code.sf.net/p/processhacker/code@5341 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- misc/website/websitev2/.htaccess | 904 ++++++++++++++++++------------- 1 file changed, 513 insertions(+), 391 deletions(-) diff --git a/misc/website/websitev2/.htaccess b/misc/website/websitev2/.htaccess index 4864ea9ad..89ed94d09 100644 --- a/misc/website/websitev2/.htaccess +++ b/misc/website/websitev2/.htaccess @@ -1,316 +1,79 @@ -# Apache configuration file -# httpd.apache.org/docs/2.2/mod/quickreference.html +# Apache Configuration File -# Note .htaccess files are an overhead, this logic should be in your Apache -# config if possible: httpd.apache.org/docs/2.2/howto/htaccess.html +# (!) Using `.htaccess` files slows down Apache, therefore, if you have access +# to the main server config file (usually called `httpd.conf`), you should add +# this logic there: http://httpd.apache.org/docs/current/howto/htaccess.html. -# Techniques in here adapted from all over, including: -# Kroc Camen: camendesign.com/.htaccess -# perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/ -# Sample .htaccess file of CMS MODx: modxcms.com +# ############################################################################## +# # CROSS-ORIGIN RESOURCE SHARING (CORS) # +# ############################################################################## +# ------------------------------------------------------------------------------ +# | Cross-domain AJAX requests | +# ------------------------------------------------------------------------------ -# ---------------------------------------------------------------------- -# Better website experience for IE users -# ---------------------------------------------------------------------- +# Enable cross-origin AJAX requests. +# http://code.google.com/p/html5security/wiki/CrossOriginRequestSecurity +# http://enable-cors.org/ -# Force the latest IE version, in various cases when it may fall back to IE7 mode -# github.com/rails/rails/commit/123eb25#commitcomment-118920 -# Use ChromeFrame if it's installed for a better experience for the poor IE folk - - - Header set X-UA-Compatible "IE=Edge,chrome=1" - # mod_headers can't match by content-type, but we don't want to send this header on *everything*... - - Header unset X-UA-Compatible - - - - -# ---------------------------------------------------------------------- -# CORS-enabled images (@crossorigin) -# ---------------------------------------------------------------------- - -# Send CORS headers if browsers request them; enabled by default for images. -# developer.mozilla.org/en/CORS_Enabled_Image -# blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html -# hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ -# wiki.mozilla.org/Security/Reviews/crossoriginAttribute - - - - # mod_headers, y u no match by Content-Type?! - - SetEnvIf Origin ":" IS_CORS - Header set Access-Control-Allow-Origin "*" env=IS_CORS - - - - - -# ---------------------------------------------------------------------- -# Webfont access -# ---------------------------------------------------------------------- - -# Allow access from all domains for webfonts. -# Alternatively you could only whitelist your -# subdomains like "subdomain.example.com". - - - - Header set Access-Control-Allow-Origin "*" - - - - -# ---------------------------------------------------------------------- -# Proper MIME type for all files -# ---------------------------------------------------------------------- - -# JavaScript -# Normalize to standard type (it's sniffed in IE anyways) -# tools.ietf.org/html/rfc4329#section-7.2 -AddType application/javascript js jsonp -AddType application/json json - -# Audio -AddType audio/mp4 m4a f4a f4b -AddType audio/ogg oga ogg - -# Video -AddType video/mp4 mp4 m4v f4v f4p -AddType video/ogg ogv -AddType video/webm webm -AddType video/x-flv flv - -# SVG -# Required for svg webfonts on iPad -# twitter.com/FontSquirrel/status/14855840545 -AddType image/svg+xml svg svgz -AddEncoding gzip svgz - -# Webfonts -AddType application/vnd.ms-fontobject eot -AddType application/x-font-ttf ttf ttc -AddType application/x-font-woff woff -AddType font/opentype otf - -# Assorted types -AddType application/octet-stream safariextz -AddType application/x-chrome-extension crx -AddType application/x-opera-extension oex -AddType application/x-shockwave-flash swf -AddType application/x-web-app-manifest+json webapp -AddType application/x-xpinstall xpi -AddType application/xml rss atom xml rdf -AddType image/webp webp -AddType image/x-icon ico -AddType text/cache-manifest appcache manifest -AddType text/vtt vtt -AddType text/x-component htc -AddType text/x-vcard vcf - - -# ---------------------------------------------------------------------- -# Gzip compression -# ---------------------------------------------------------------------- - - - - # Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ - - - SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding - RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding - - - - # Compress all output labeled with one of the following MIME-types - # (for Apache versions below 2.3.7, you don't need to enable `mod_filter` - # and can remove the `` and `` lines as - # `AddOutputFilterByType` is still in the core directives) -# - AddOutputFilterByType DEFLATE application/atom+xml \ - application/javascript \ - application/json \ - application/rss+xml \ - application/vnd.ms-fontobject \ - application/x-font-ttf \ - application/xhtml+xml \ - application/xml \ - font/opentype \ - image/svg+xml \ - image/x-icon \ - text/css \ - text/html \ - text/plain \ - text/x-component \ - text/xml -# - - - - -# ---------------------------------------------------------------------- -# Expires headers (for better cache control) -# ---------------------------------------------------------------------- - -# These are pretty far-future expires headers. -# They assume you control versioning with filename-based cache busting -# Additionally, consider that outdated proxies may miscache -# www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ - -# If you don't use filenames to version, lower the CSS and JS to something like -# "access plus 1 week". - - - ExpiresActive on - -# Perhaps better to whitelist expires rules? Perhaps. - ExpiresDefault "access plus 1 month" - -# cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) - ExpiresByType text/cache-manifest "access plus 0 seconds" - -# Your document html - ExpiresByType text/html "access plus 0 seconds" - -# Data - ExpiresByType application/json "access plus 0 seconds" - ExpiresByType application/xml "access plus 0 seconds" - ExpiresByType text/xml "access plus 0 seconds" - -# Feed - ExpiresByType application/atom+xml "access plus 1 hour" - ExpiresByType application/rss+xml "access plus 1 hour" - -# Favicon (cannot be renamed) - ExpiresByType image/x-icon "access plus 1 week" - -# Media: images, video, audio - ExpiresByType audio/ogg "access plus 1 month" - ExpiresByType image/gif "access plus 1 month" - ExpiresByType image/jpeg "access plus 1 month" - ExpiresByType image/png "access plus 1 month" - ExpiresByType video/mp4 "access plus 1 month" - ExpiresByType video/ogg "access plus 1 month" - ExpiresByType video/webm "access plus 1 month" - -# HTC files (css3pie) - ExpiresByType text/x-component "access plus 1 month" - -# Webfonts - ExpiresByType application/vnd.ms-fontobject "access plus 1 month" - ExpiresByType application/x-font-ttf "access plus 1 month" - ExpiresByType application/x-font-woff "access plus 1 month" - ExpiresByType font/opentype "access plus 1 month" - ExpiresByType image/svg+xml "access plus 1 month" - -# CSS and JavaScript - ExpiresByType application/javascript "access plus 1 week" - ExpiresByType text/css "access plus 1 week" - - - - -# ---------------------------------------------------------------------- -# ETag removal -# ---------------------------------------------------------------------- - -# FileETag None is not enough for every server. - - Header unset ETag - - -# Since we're sending far-future expires, we don't need ETags for -# static content. -# developer.yahoo.com/performance/rules.html#etags -FileETag None - - -# ---------------------------------------------------------------------- -# Start rewrite engine -# ---------------------------------------------------------------------- - -# Turning on the rewrite engine is necessary for the following rules and -# features. FollowSymLinks must be enabled for this to work. - -# Some cloud hosting services require RewriteBase to be set: goo.gl/HOcPN -# If using the h5bp in a subdirectory, use `RewriteBase /foo` instead where -# 'foo' is your directory. - -# If your web host doesn't allow the FollowSymlinks option, you may need to -# comment it out and use `Options +SymLinksIfOwnerMatch`, but be aware of the -# performance impact: http://goo.gl/Mluzd - - - Options +FollowSymlinks -# Options +SymLinksIfOwnerMatch - RewriteEngine On -# RewriteBase / - - - -# ---------------------------------------------------------------------- -# Suppress or force the "www." at the beginning of URLs -# ---------------------------------------------------------------------- - -# The same content should never be available under two different URLs - -# especially not with and without "www." at the beginning, since this can cause -# SEO problems (duplicate content). That's why you should choose one of the -# alternatives and redirect the other one. - -# By default option 1 (no "www.") is activated. -# no-www.org/faq.php?q=class_b - -# If you'd prefer to use option 2, just comment out all option 1 lines -# and uncomment option 2. - -# IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME! - -# ---------------------------------------------------------------------- - -# Option 1: -# Rewrite "www.example.com -> example.com". - - - RewriteCond %{HTTPS} !=on - RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] - RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L] - - -# ---------------------------------------------------------------------- - -# Option 2: -# Rewrite "example.com -> www.example.com". -# Be aware that the following rule might not be a good idea if you use "real" -# subdomains for certain parts of your website. - -# -# RewriteCond %{HTTPS} !=on -# RewriteCond %{HTTP_HOST} !^www\..+$ [NC] -# RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] +# +# Header set Access-Control-Allow-Origin "*" # +# ------------------------------------------------------------------------------ +# | CORS-enabled images | +# ------------------------------------------------------------------------------ -# ---------------------------------------------------------------------- -# Prevent 404 errors for non-existing redirected folders -# ---------------------------------------------------------------------- +# Send the CORS header for images when browsers request it. +# https://developer.mozilla.org/en/CORS_Enabled_Image +# http://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html +# http://hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ -# without -MultiViews, Apache will give a 404 for a rewrite if a folder of the -# same name does not exist. -# webmasterworld.com/apache/3808792.htm + + + + SetEnvIf Origin ":" IS_CORS + Header set Access-Control-Allow-Origin "*" env=IS_CORS + + + + +# ------------------------------------------------------------------------------ +# | Web fonts access | +# ------------------------------------------------------------------------------ + +# Allow access from all domains for web fonts + + + + Header set Access-Control-Allow-Origin "*" + + + + +# ############################################################################## +# # ERRORS # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | 404 error prevention for non-existing redirected folders | +# ------------------------------------------------------------------------------ + +# Prevent Apache from returning a 404 error for a rewrite if a directory +# with the same name does not exist. +# http://httpd.apache.org/docs/current/content-negotiation.html#multiviews +# http://www.webmasterworld.com/apache/3808792.htm Options -MultiViews +# ------------------------------------------------------------------------------ +# | Custom error messages / pages | +# ------------------------------------------------------------------------------ -# ---------------------------------------------------------------------- -# Custom 404 page -# ---------------------------------------------------------------------- +# You can customize what Apache returns to the client in case of an error (see +# http://httpd.apache.org/docs/current/mod/core.html#errordocument), e.g.: -# You can add custom pages to handle 500 or 403 pretty easily, if you like. -# If you are hosting your site in subdirectory, adjust this accordingly -# e.g. ErrorDocument 404 /subdir/404.html +#ErrorDocument 404 /404.html ErrorDocument 400 /error.php ErrorDocument 401 /error.php @@ -319,115 +82,485 @@ ErrorDocument 404 /error.php ErrorDocument 405 /error.php ErrorDocument 500 /error.php +# ############################################################################## +# # INTERNET EXPLORER # +# ############################################################################## -# ---------------------------------------------------------------------- -# UTF-8 encoding -# ---------------------------------------------------------------------- +# ------------------------------------------------------------------------------ +# | Better website experience | +# ------------------------------------------------------------------------------ -# Use UTF-8 encoding for anything served text/plain or text/html +# Force IE to render pages in the highest available mode in the various +# cases when it may not: http://hsivonen.iki.fi/doctype/ie-mode.pdf. + + + Header set X-UA-Compatible "IE=edge" + # `mod_headers` can't match based on the content-type, however, we only + # want to send this header for HTML pages and not for the other resources + + Header unset X-UA-Compatible + + + +# ------------------------------------------------------------------------------ +# | Cookie setting from iframes | +# ------------------------------------------------------------------------------ + +# Allow cookies to be set from iframes in IE. + +# +# Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" +# + +# ------------------------------------------------------------------------------ +# | Screen flicker | +# ------------------------------------------------------------------------------ + +# Stop screen flicker in IE on CSS rollovers (this only works in +# combination with the `ExpiresByType` directives for images from below). + +# BrowserMatch "MSIE" brokenvary=1 +# BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1 +# BrowserMatch "Opera" !brokenvary +# SetEnvIf brokenvary 1 force-no-vary + + +# ############################################################################## +# # MIME TYPES AND ENCODING # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | Proper MIME types for all files | +# ------------------------------------------------------------------------------ + + + + # Audio + AddType audio/mp4 m4a f4a f4b + AddType audio/ogg oga ogg + + # JavaScript + # Normalize to standard type (it's sniffed in IE anyways): + # http://tools.ietf.org/html/rfc4329#section-7.2 + AddType application/javascript js jsonp + AddType application/json json + + # Video + AddType video/mp4 mp4 m4v f4v f4p + AddType video/ogg ogv + AddType video/webm webm + AddType video/x-flv flv + + # Web fonts + AddType application/font-woff woff + AddType application/vnd.ms-fontobject eot + + # Browsers usually ignore the font MIME types and sniff the content, + # however, Chrome shows a warning if other MIME types are used for the + # following fonts. + AddType application/x-font-ttf ttc ttf + AddType font/opentype otf + + # Make SVGZ fonts work on iPad: + # https://twitter.com/FontSquirrel/status/14855840545 + AddType image/svg+xml svg svgz + AddEncoding gzip svgz + + # Other + AddType application/octet-stream safariextz + AddType application/x-chrome-extension crx + AddType application/x-opera-extension oex + AddType application/x-shockwave-flash swf + AddType application/x-web-app-manifest+json webapp + AddType application/x-xpinstall xpi + AddType application/xml atom rdf rss xml + AddType image/webp webp + AddType image/x-icon ico + AddType text/cache-manifest appcache manifest + AddType text/vtt vtt + AddType text/x-component htc + AddType text/x-vcard vcf + + + +# ------------------------------------------------------------------------------ +# | UTF-8 encoding | +# ------------------------------------------------------------------------------ + +# Use UTF-8 encoding for anything served as `text/html` or `text/plain`. AddDefaultCharset utf-8 -# Force UTF-8 for a number of file formats -AddCharset utf-8 .atom .css .js .json .rss .vtt .xml - - -# ---------------------------------------------------------------------- -# A little more security -# ---------------------------------------------------------------------- - -# To avoid displaying the exact version number of Apache being used, add the -# following to httpd.conf (it will not work in .htaccess): -# ServerTokens Prod - -# "-Indexes" will have Apache block users from browsing folders without a -# default document Usually you should leave this activated, because you -# shouldn't allow everybody to surf through every folder on your server (which -# includes rather private places like CMS system folders). - - Options -Indexes +# Force UTF-8 for certain file formats. + + AddCharset utf-8 .atom .css .js .json .rss .vtt .webapp .xml -# Block access to "hidden" directories or files whose names begin with a -# period. This includes directories used by version control systems such as -# Subversion or Git. + +# ############################################################################## +# # URL REWRITES # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | Rewrite engine | +# ------------------------------------------------------------------------------ + +# Turning on the rewrite engine and enabling the `FollowSymLinks` option is +# necessary for the following directives to work. + +# If your web host doesn't allow the `FollowSymlinks` option, you may need to +# comment it out and use `Options +SymLinksIfOwnerMatch` but, be aware of the +# performance impact: http://httpd.apache.org/docs/current/misc/perf-tuning.html#symlinks + +# Also, some cloud hosting services require `RewriteBase` to be set: +# http://www.rackspace.com/knowledge_center/frequently-asked-question/why-is-mod-rewrite-not-working-on-my-site + - RewriteCond %{SCRIPT_FILENAME} -d [OR] - RewriteCond %{SCRIPT_FILENAME} -f - RewriteRule "(^|/)\." - [F] + Options +FollowSymlinks + # Options +SymLinksIfOwnerMatch + RewriteEngine On + # RewriteBase / + + # custom PH code + # This redirect is for fixing an error on TechRadar, their link to the project has %20 at the end... + # http://www.techradar.com/news/computing/pc/how-to-free-up-ram-899817 + # Remap %20 (Space) back to the project index, until they fix it... + Redirect 301 "/ " http://processhacker.sourceforge.net/index.php + + # Remap old image links to the new locations for compatiblity with old websites + Redirect 301 "/images/logo.png" http://processhacker.sourceforge.net/images/logo_64x64.png + Redirect 301 "/images/processes.png" http://processhacker.sourceforge.net/images/screenshots/processhacker_small.png + Redirect 301 "/images/processhacker_small.png" http://processhacker.sourceforge.net/images/screenshots/processhacker_small.png + Redirect 301 "/images/sysinfo_small.png" http://processhacker.sourceforge.net/images/screenshots/sysinfo_small.png + -# Block access to backup and source files. These files may be left by some -# text/html editors and pose a great security danger, when anyone can access -# them. - - Order allow,deny - Deny from all - Satisfy All +# ------------------------------------------------------------------------------ +# | Suppressing / Forcing the "www." at the beginning of URLs | +# ------------------------------------------------------------------------------ + +# The same content should never be available under two different URLs especially +# not with and without "www." at the beginning. This can cause SEO problems +# (duplicate content), therefore, you should choose one of the alternatives and +# redirect the other one. + +# By default option 1 (no "www.") is activated: +# http://no-www.org/faq.php?q=class_b + +# If you'd prefer to use option 2, just comment out all the lines from option 1 +# and uncomment the ones from option 2. + +# IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME! + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Option 1: rewrite www.example.com → example.com + + + RewriteCond %{HTTPS} !=on + RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] + RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L] + + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Option 2: rewrite example.com → www.example.com + +# Be aware that the following might not be a good idea if you use "real" +# subdomains for certain parts of your website. + +# +# RewriteCond %{HTTPS} !=on +# RewriteCond %{HTTP_HOST} !^www\..+$ [NC] +# RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] +# + + +# ############################################################################## +# # SECURITY # +# ############################################################################## + +# ------------------------------------------------------------------------------ +# | Content Security Policy (CSP) | +# ------------------------------------------------------------------------------ + +# You can mitigate the risk of cross-site scripting and other content-injection +# attacks by setting a Content Security Policy which whitelists trusted sources +# of content for your site. + +# The example header below allows ONLY scripts that are loaded from the current +# site's origin (no inline scripts, no CDN, etc). This almost certainly won't +# work as-is for your site! + +# To get all the details you'll need to craft a reasonable policy for your site, +# read: http://html5rocks.com/en/tutorials/security/content-security-policy (or +# see the specification: http://w3.org/TR/CSP). + +# +# Header set Content-Security-Policy "script-src 'self'; object-src 'self'" +# +# Header unset Content-Security-Policy +# +# + +# ------------------------------------------------------------------------------ +# | File access | +# ------------------------------------------------------------------------------ + +# Block access to directories without a default document. +# Usually you should leave this uncommented because you shouldn't allow anyone +# to surf through every directory on your server (which may includes rather +# private places like the CMS's directories). + + + Options -Indexes + + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Block access to hidden files and directories. +# This includes directories used by version control systems such as Git and SVN. + + + RewriteCond %{SCRIPT_FILENAME} -d [OR] + RewriteCond %{SCRIPT_FILENAME} -f + RewriteRule "(^|/)\." - [F] + + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Block access to backup and source files. +# These files may be left by some text editors and can pose a great security +# danger when anyone has access to them. + + + Order allow,deny + Deny from all + Satisfy All -# If your server is not already configured as such, the following directive -# should be uncommented in order to set PHP's register_globals option to OFF. -# This closes a major security hole that is abused by most XSS (cross-site -# scripting) attacks. For more information: http://php.net/register_globals -# -# IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS: -# -# Your server does not allow PHP directives to be set via .htaccess. In that -# case you must make this change in your php.ini file instead. If you are -# using a commercial web host, contact the administrators for assistance in -# doing this. Not all servers allow local php.ini files, and they should -# include all PHP configurations (not just this one), or you will effectively -# reset everything to PHP defaults. Consult www.php.net for more detailed -# information about setting PHP directives. +# ------------------------------------------------------------------------------ +# | Secure Sockets Layer (SSL) | +# ------------------------------------------------------------------------------ -# php_flag register_globals Off +# Rewrite secure requests properly to prevent SSL certificate warnings, e.g.: +# prevent `https://www.example.com` when your certificate only allows +# `https://secure.example.com`. -# Rename session cookie to something else, than PHPSESSID -# php_value session.name sid +# +# RewriteCond %{SERVER_PORT} !^443 +# RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L] +# -# Disable magic quotes (This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.) -# php_flag magic_quotes_gpc Off +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -# Do not show you are using PHP -# Note: Move this line to php.ini since it won't work in .htaccess -# php_flag expose_php Off +# Force client-side SSL redirection. -# Level of log detail - log all errors -# php_value error_reporting -1 +# If a user types "example.com" in his browser, the above rule will redirect him +# to the secure version of the site. That still leaves a window of opportunity +# (the initial HTTP connection) for an attacker to downgrade or redirect the +# request. The following header ensures that browser will ONLY connect to your +# server via HTTPS, regardless of what the users type in the address bar. +# http://www.html5rocks.com/en/tutorials/security/transport-layer-security/ -# Write errors to log file -# php_flag log_errors On +# +# Header set Strict-Transport-Security max-age=16070400; +# -# Do not display errors in browser (production - Off, development - On) -# php_flag display_errors Off +# ------------------------------------------------------------------------------ +# | Server software information | +# ------------------------------------------------------------------------------ -# Do not display startup errors (production - Off, development - On) -# php_flag display_startup_errors Off +# Avoid displaying the exact Apache version number, the description of the +# generic OS-type and the information about Apache's compiled-in modules. -# Format errors in plain text -# Note: Leave this setting 'On' for xdebug's var_dump() output -# php_flag html_errors Off +# ADD THIS DIRECTIVE IN THE `httpd.conf` AS IT WILL NOT WORK IN THE `.htaccess`! -# Show multiple occurrence of error -# php_flag ignore_repeated_errors Off +# ServerTokens Prod -# Show same errors from different sources -# php_flag ignore_repeated_source Off -# Size limit for error messages -# php_value log_errors_max_len 1024 +# ############################################################################## +# # WEB PERFORMANCE # +# ############################################################################## -# Don't precede error with string (doesn't accept empty string, use whitespace if you need) -# php_value error_prepend_string " " +# ------------------------------------------------------------------------------ +# | Compression | +# ------------------------------------------------------------------------------ -# Don't prepend to error (doesn't accept empty string, use whitespace if you need) -# php_value error_append_string " " + + + # Force compression for mangled headers. + # http://developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping + + + SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding + RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding + + + + # Compress all output labeled with one of the following MIME-types + # (for Apache versions below 2.3.7, you don't need to enable `mod_filter` + # and can remove the `` and `` lines + # as `AddOutputFilterByType` is still in the core directives). +# + AddOutputFilterByType DEFLATE application/atom+xml \ + application/javascript \ + application/json \ + application/rss+xml \ + application/vnd.ms-fontobject \ + application/x-font-ttf \ + application/x-web-app-manifest+json \ + application/xhtml+xml \ + application/xml \ + font/opentype \ + image/svg+xml \ + image/x-icon \ + text/css \ + text/html \ + text/plain \ + text/x-component \ + text/xml +# -# Increase cookie security - - php_value session.cookie_httponly true +# ------------------------------------------------------------------------------ +# | Content transformations | +# ------------------------------------------------------------------------------ + +# Prevent some of the mobile network providers from modifying the content of +# your site: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.5. + +# +# Header set Cache-Control "no-transform" +# + +# ------------------------------------------------------------------------------ +# | ETag removal | +# ------------------------------------------------------------------------------ + +# Since we're sending far-future expires headers (see below), ETags can +# be removed: http://developer.yahoo.com/performance/rules.html#etags. + +# `FileETag None` is not enough for every server. + + Header unset ETag + + +FileETag None + +# ------------------------------------------------------------------------------ +# | Expires headers (for better cache control) | +# ------------------------------------------------------------------------------ + +# The following expires headers are set pretty far in the future. If you don't +# control versioning with filename-based cache busting, consider lowering the +# cache time for resources like CSS and JS to something like 1 week. + + + + ExpiresActive on + ExpiresDefault "access plus 1 month" + + # CSS + ExpiresByType text/css "access plus 1 week" + + # Data interchange + ExpiresByType application/json "access plus 0 seconds" + ExpiresByType application/xml "access plus 0 seconds" + ExpiresByType text/xml "access plus 0 seconds" + + # Favicon (cannot be renamed!) + ExpiresByType image/x-icon "access plus 1 week" + + # HTML components (HTCs) + ExpiresByType text/x-component "access plus 1 month" + + # HTML + ExpiresByType text/html "access plus 0 seconds" + + # JavaScript + ExpiresByType application/javascript "access plus 1 week" + + # Manifest files + ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds" + ExpiresByType text/cache-manifest "access plus 0 seconds" + + # Media + ExpiresByType audio/ogg "access plus 1 month" + ExpiresByType image/gif "access plus 1 month" + ExpiresByType image/jpeg "access plus 1 month" + ExpiresByType image/png "access plus 1 month" + ExpiresByType video/mp4 "access plus 1 month" + ExpiresByType video/ogg "access plus 1 month" + ExpiresByType video/webm "access plus 1 month" + + # Web feeds + ExpiresByType application/atom+xml "access plus 1 hour" + ExpiresByType application/rss+xml "access plus 1 hour" + + # Web fonts + ExpiresByType application/font-woff "access plus 1 month" + ExpiresByType application/vnd.ms-fontobject "access plus 1 month" + ExpiresByType application/x-font-ttf "access plus 1 month" + ExpiresByType font/opentype "access plus 1 month" + ExpiresByType image/svg+xml "access plus 1 month" + + + +# ------------------------------------------------------------------------------ +# | Filename-based cache busting | +# ------------------------------------------------------------------------------ + +# If you're not using a build process to manage your filename version revving, +# you might want to consider enabling the following directives to route all +# requests such as `/css/style.12345.css` to `/css/style.css`. + +# To understand why this is important and a better idea than `*.css?v231`, read: +# http://stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring + +# +# RewriteCond %{REQUEST_FILENAME} !-f +# RewriteCond %{REQUEST_FILENAME} !-d +# RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L] +# + +# ------------------------------------------------------------------------------ +# | File concatenation | +# ------------------------------------------------------------------------------ + +# Allow concatenation from within specific CSS and JS files, e.g.: +# Inside of `script.combined.js` you could have +# +# +# and they would be included into this single file. + +# +# +# Options +Includes +# AddOutputFilterByType INCLUDES application/javascript application/json +# SetOutputFilter INCLUDES +# +# +# Options +Includes +# AddOutputFilterByType INCLUDES text/css +# SetOutputFilter INCLUDES +# +# + +# ------------------------------------------------------------------------------ +# | Persistent connections | +# ------------------------------------------------------------------------------ + +# Allow multiple requests to be sent over the same TCP connection: +# http://httpd.apache.org/docs/current/en/mod/core.html#keepalive. + +# Enable if you serve a lot of static content but, be aware of the +# possible disadvantages! + +# +# Header set Connection Keep-Alive +# + # custom PH code Order Allow,Deny @@ -439,14 +572,3 @@ allow from all php_value memory_limit 32M - -# This redirect is for fixing an error on TechRadar, their link to the project has %20 at the end... -# http://www.techradar.com/news/computing/pc/how-to-free-up-ram-899817 -# Remap %20 (Space) back to the project index, until they fix it... -Redirect 301 "/ " http://processhacker.sourceforge.net/index.php - -# Remap old image links to the new locations for compatiblity with old websites -Redirect 301 "/images/logo.png" http://processhacker.sourceforge.net/images/logo_64x64.png -Redirect 301 "/images/processes.png" http://processhacker.sourceforge.net/images/screenshots/processhacker_small.png -Redirect 301 "/images/processhacker_small.png" http://processhacker.sourceforge.net/images/screenshots/processhacker_small.png -Redirect 301 "/images/sysinfo_small.png" http://processhacker.sourceforge.net/images/screenshots/sysinfo_small.png