# PKO @ 50

Options -Indexes
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Force HTTPS. Comment these two lines out until the SSL certificate is issued.
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Never serve raw configuration, database or instruction files.
# Both syntaxes are present so this works on Apache 2.4 and on 2.2.
<FilesMatch "\.(sql|log|md|ini)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<Files "DEPLOY.txt">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css            "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/jpeg          "access plus 30 days"
  ExpiresByType image/png           "access plus 30 days"
</IfModule>
