# Turn on URL rewriting
RewriteEngine On
# Hides server version on Apache
# http://www.ducea.com/2006/06/15/apache-tips-tricks-hide-apache-software-version/
ServerTokens ProductOnly
ServerSignature Off
# Forces https
<IfModule mod_rewrite.c>
#RewriteCond %{SERVER_PORT} !^443
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# Set certificate pinning
# https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning
<IfModule mod_headers.c>
#Header set Public-Key-Pins "max-age=500; includeSubDomains; pin-sha256=\"\"; report-uri=\"report-uri\"";
</IfModule>
# Sets HSTS (Strict-Transport-Security)
# https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
<IfModule mod_headers.c>
#Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
</IfModule>
</IfModule>
<IfModule mod_headers.c>
# Disable displaying webpage in Iframes -> prevents Clickjacking
# https://www.owasp.org/index.php/Clickjacking
Header set X-Frame-Options SAMEORIGIN
# Block requests with incorrect MIME-types
# https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Content-Type-Options
Header set X-Content-Type-Options "nosniff"
# Set IE-8 XSS Filter on
# https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-XSS-Protection
Header set X-XSS-Protection "1; mode=block"
# Disable Flash cross-domain requests
# https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Permitted-Cross-Domain-Policies
Header set X-Permitted-Cross-Domain-Policies "none"
</IfModule>
# Installation directory
RewriteBase /
# Protect hidden files from being viewed
<Files .*>
Require all denied
</Files>
# Allow any files or directories that exist to be displayed directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# Rewrite all other URLs to index.php/URL
# godaddy hack no input file specified
RewriteRule .* index.php [PT,QSA,L]