|
| 1 | +# |
| 2 | +# Apache/PHP/Drupal settings: |
| 3 | +# |
| 4 | + |
| 5 | +# Protect files and directories from prying eyes. |
| 6 | +<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$"> |
| 7 | + Order allow,deny |
| 8 | +</FilesMatch> |
| 9 | + |
| 10 | +# Don't show directory listings for URLs which map to a directory. |
| 11 | +Options -Indexes |
| 12 | + |
| 13 | +# Follow symbolic links in this directory. |
| 14 | +Options +FollowSymLinks |
| 15 | + |
| 16 | +# Make Drupal handle any 404 errors. |
| 17 | +ErrorDocument 404 /index.php |
| 18 | + |
| 19 | +# Set the default handler. |
| 20 | +DirectoryIndex index.php index.html index.htm |
| 21 | + |
| 22 | +# Override PHP settings that cannot be changed at runtime. See |
| 23 | +# sites/default/default.settings.php and drupal_environment_initialize() in |
| 24 | +# includes/bootstrap.inc for settings that can be changed at runtime. |
| 25 | + |
| 26 | +# PHP 5, Apache 1 and 2. |
| 27 | +<IfModule mod_php5.c> |
| 28 | + php_flag magic_quotes_gpc off |
| 29 | + php_flag magic_quotes_sybase off |
| 30 | + php_flag register_globals off |
| 31 | + php_flag session.auto_start off |
| 32 | + php_value mbstring.http_input pass |
| 33 | + php_value mbstring.http_output pass |
| 34 | + php_flag mbstring.encoding_translation off |
| 35 | +</IfModule> |
| 36 | + |
| 37 | +# Requires mod_expires to be enabled. |
| 38 | +<IfModule mod_expires.c> |
| 39 | + # Enable expirations. |
| 40 | + ExpiresActive On |
| 41 | + |
| 42 | + # Cache all files for 2 weeks after access (A). |
| 43 | + ExpiresDefault A1209600 |
| 44 | + |
| 45 | + <FilesMatch \.php$> |
| 46 | + # Do not allow PHP scripts to be cached unless they explicitly send cache |
| 47 | + # headers themselves. Otherwise all scripts would have to overwrite the |
| 48 | + # headers set by mod_expires if they want another caching behavior. This may |
| 49 | + # fail if an error occurs early in the bootstrap process, and it may cause |
| 50 | + # problems if a non-Drupal PHP file is installed in a subdirectory. |
| 51 | + ExpiresActive Off |
| 52 | + </FilesMatch> |
| 53 | +</IfModule> |
| 54 | + |
| 55 | +# Various rewrite rules. |
| 56 | +<IfModule mod_rewrite.c> |
| 57 | + RewriteEngine on |
| 58 | + |
| 59 | + # Set "protossl" to "s" if we were accessed via https://. This is used later |
| 60 | + # if you enable "www." stripping or enforcement, in order to ensure that |
| 61 | + # you don't bounce between http and https. |
| 62 | + RewriteRule ^ - [E=protossl] |
| 63 | + RewriteCond %{HTTPS} on |
| 64 | + RewriteRule ^ - [E=protossl:s] |
| 65 | + |
| 66 | + # Make sure Authorization HTTP header is available to PHP |
| 67 | + # even when running as CGI or FastCGI. |
| 68 | + RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] |
| 69 | + |
| 70 | + # Block access to "hidden" directories whose names begin with a period. This |
| 71 | + # includes directories used by version control systems such as Subversion or |
| 72 | + # Git to store control files. Files whose names begin with a period, as well |
| 73 | + # as the control files used by CVS, are protected by the FilesMatch directive |
| 74 | + # above. |
| 75 | + # |
| 76 | + # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is |
| 77 | + # not possible to block access to entire directories from .htaccess, because |
| 78 | + # <DirectoryMatch> is not allowed here. |
| 79 | + # |
| 80 | + # If you do not have mod_rewrite installed, you should remove these |
| 81 | + # directories from your webroot or otherwise protect them from being |
| 82 | + # downloaded. |
| 83 | + RewriteRule "(^|/)\." - [F] |
| 84 | + |
| 85 | + # If your site can be accessed both with and without the 'www.' prefix, you |
| 86 | + # can use one of the following settings to redirect users to your preferred |
| 87 | + # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option: |
| 88 | + # |
| 89 | + # To redirect all users to access the site WITH the 'www.' prefix, |
| 90 | + # (http://example.com/... will be redirected to http://www.example.com/...) |
| 91 | + # uncomment the following: |
| 92 | + # RewriteCond %{HTTP_HOST} . |
| 93 | + # RewriteCond %{HTTP_HOST} !^www\. [NC] |
| 94 | + # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] |
| 95 | + # |
| 96 | + # To redirect all users to access the site WITHOUT the 'www.' prefix, |
| 97 | + # (http://www.example.com/... will be redirected to http://example.com/...) |
| 98 | + # uncomment the following: |
| 99 | + # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] |
| 100 | + # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301] |
| 101 | + |
| 102 | + # Modify the RewriteBase if you are using Drupal in a subdirectory or in a |
| 103 | + # VirtualDocumentRoot and the rewrite rules are not working properly. |
| 104 | + # For example if your site is at http://example.com/drupal uncomment and |
| 105 | + # modify the following line: |
| 106 | + # RewriteBase /drupal |
| 107 | + # |
| 108 | + # If your site is running in a VirtualDocumentRoot at http://example.com/, |
| 109 | + # uncomment the following line: |
| 110 | + # RewriteBase / |
| 111 | + |
| 112 | + # Pass all requests not referring directly to files in the filesystem to |
| 113 | + # index.php. Clean URLs are handled in drupal_environment_initialize(). |
| 114 | + RewriteCond %{REQUEST_FILENAME} !-f |
| 115 | + RewriteCond %{REQUEST_FILENAME} !-d |
| 116 | + RewriteCond %{REQUEST_URI} !=/favicon.ico |
| 117 | + RewriteRule ^ index.php [L] |
| 118 | + |
| 119 | + # Rules to correctly serve gzip compressed CSS and JS files. |
| 120 | + # Requires both mod_rewrite and mod_headers to be enabled. |
| 121 | + <IfModule mod_headers.c> |
| 122 | + # Serve gzip compressed CSS files if they exist and the client accepts gzip. |
| 123 | + RewriteCond %{HTTP:Accept-encoding} gzip |
| 124 | + RewriteCond %{REQUEST_FILENAME}\.gz -s |
| 125 | + RewriteRule ^(.*)\.css $1\.css\.gz [QSA] |
| 126 | + |
| 127 | + # Serve gzip compressed JS files if they exist and the client accepts gzip. |
| 128 | + RewriteCond %{HTTP:Accept-encoding} gzip |
| 129 | + RewriteCond %{REQUEST_FILENAME}\.gz -s |
| 130 | + RewriteRule ^(.*)\.js $1\.js\.gz [QSA] |
| 131 | + |
| 132 | + # Serve correct content types, and prevent mod_deflate double gzip. |
| 133 | + RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1] |
| 134 | + RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1] |
| 135 | + |
| 136 | + <FilesMatch "(\.js\.gz|\.css\.gz)$"> |
| 137 | + # Serve correct encoding type. |
| 138 | + Header set Content-Encoding gzip |
| 139 | + # Force proxies to cache gzipped & non-gzipped css/js files separately. |
| 140 | + Header append Vary Accept-Encoding |
| 141 | + </FilesMatch> |
| 142 | + </IfModule> |
| 143 | +</IfModule> |
0 commit comments