mark
/
msos
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: force HTTPS + HSTS #12

Merged
popovskik merged 1 commits from kristijan-dev into develop 2026-08-04 08:39:59 +00:00
Conversation 0 Commits 1 Files Changed 1 +12
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
.htaccess
View File

@ -1,6 +1,14 @@
RewriteEngine on RewriteEngine on
# ----- Force HTTPS everywhere -----
# Redirect any plain-http request to https. The two conditions together avoid
# a redirect loop when TLS is terminated by an upstream proxy (which forwards
# X-Forwarded-Proto: https while %{HTTPS} may read as off).
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# ----- Language root redirect ----- # ----- Language root redirect -----
# Send the bare root to the default-language homepage, on WHATEVER host is # Send the bare root to the default-language homepage, on WHATEVER host is
# serving the site (relative — no cross-domain redirect). Do NOT force # serving the site (relative — no cross-domain redirect). Do NOT force
@ -74,6 +82,10 @@ Options -Indexes
</IfModule> </IfModule>
<IfModule mod_headers.c> <IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff" Header set X-Content-Type-Options "nosniff"
# HSTS: after the first HTTPS visit, browsers refuse plain HTTP for this
# host. Conservative 6-month max-age, no preload/includeSubDomains so it
# stays easy to adjust. (Ignored by browsers over plain HTTP — harmless.)
Header always set Strict-Transport-Security "max-age=15768000"
# Clickjacking protection — the site should never be framed by other origins. # Clickjacking protection — the site should never be framed by other origins.
Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Frame-Options "SAMEORIGIN"
# Don't leak full page URLs to third parties (analytics, external links). # Don't leak full page URLs to third parties (analytics, external links).