mark
/
msos
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: mark:15624454e834234aa8825e8a81c7821a77f4b01a
Branches Tags
mark:master
mark:develop
mark:kristijan-dev
..
compare: mark:77dc3ae940aa9a93d552285c6422bd39086db438
Branches Tags
mark:master
mark:develop
mark:kristijan-dev

No commits in common. "15624454e834234aa8825e8a81c7821a77f4b01a" and "77dc3ae940aa9a93d552285c6422bd39086db438" have entirely different histories.
15624454e8 ... 77dc3ae940

1 changed files with 0 additions and 12 deletions
Show Stats Expand all files Collapse all files

12
.htaccess
View File

@ -1,14 +1,6 @@
RewriteEngine on RewriteEngine on
# ----- Force HTTPS everywhere -----
# Redirect any plain-http request to https. The two conditions together avoid
# a redirect loop when TLS is terminated by an upstream proxy (which forwards
# X-Forwarded-Proto: https while %{HTTPS} may read as off).
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# ----- Language root redirect ----- # ----- Language root redirect -----
# Send the bare root to the default-language homepage, on WHATEVER host is # Send the bare root to the default-language homepage, on WHATEVER host is
# serving the site (relative — no cross-domain redirect). Do NOT force # serving the site (relative — no cross-domain redirect). Do NOT force
@ -82,10 +74,6 @@ Options -Indexes
</IfModule> </IfModule>
<IfModule mod_headers.c> <IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff" Header set X-Content-Type-Options "nosniff"
# HSTS: after the first HTTPS visit, browsers refuse plain HTTP for this
# host. Conservative 6-month max-age, no preload/includeSubDomains so it
# stays easy to adjust. (Ignored by browsers over plain HTTP — harmless.)
Header always set Strict-Transport-Security "max-age=15768000"
# Clickjacking protection — the site should never be framed by other origins. # Clickjacking protection — the site should never be framed by other origins.
Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Frame-Options "SAMEORIGIN"
# Don't leak full page URLs to third parties (analytics, external links). # Don't leak full page URLs to third parties (analytics, external links).