.htaccess

Options -Indexes

# Security Headers
Header always set Content-Security-Policy "frame-ancestors 'none'"
Header always set Referrer-Policy "no-referrer"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# cache images for 4 weeks
<FilesMatch "\.(gif|jpe?g|png|ico)$">
Header set Cache-Control: "max-age=2419200"
</FilesMatch>

# cache scripts, CSS For 1 week
<FilesMatch "\.(js|css)$">
Header set Cache-Control: "max-age=604800"
</FilesMatch>


<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# Redirect to HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<ifModule mod_expires.c>
ExpiresActive On
ExpiresByType image/gif "access plus 1 weeks"
ExpiresByType image/jpg "access plus 1 weeks"
ExpiresByType image/jpeg "access plus 1 weeks"
ExpiresByType image/png "access plus 1 weeks"
ExpiresByType image/vnd.microsoft.icon "access plus 1 weeks"
ExpiresByType image/x-icon "access plus 1 weeks"
ExpiresByType image/ico "access plus 1 weeks"
ExpiresByType application/javascript "now plus 1 weeks"
ExpiresByType application/x-javascript "now plus 1 weeks"
ExpiresByType text/javascript "now plus 1 weeks"
ExpiresByType text/css "now plus 1 weeks"
ExpiresDefault "access plus 1 days"
</ifModule>