Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

AddDefaultCharset UTF-8
DirectoryIndex index.php
ErrorDocument 404 /index.php
ErrorDocument 403 /index.php

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json
  AddOutputFilterByType DEFLATE image/svg+xml application/xml text/xml
  AddOutputFilterByType DEFLATE font/woff2 font/woff
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "^service-worker\.js$">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
    Header set Pragma "no-cache"
    Header set Expires "0"
  </FilesMatch>
  <FilesMatch "^manifest\.json$">
    Header set Cache-Control "public, max-age=86400"
  </FilesMatch>
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html                "access plus 0 seconds"
  ExpiresByType text/css                 "access plus 1 week"
  ExpiresByType application/javascript   "access plus 1 week"
  ExpiresByType text/javascript          "access plus 1 week"
  ExpiresByType image/jpeg               "access plus 1 month"
  ExpiresByType image/png                "access plus 1 month"
  ExpiresByType image/webp               "access plus 1 month"
  ExpiresByType image/svg+xml            "access plus 1 month"
  ExpiresByType image/x-icon             "access plus 1 year"
  ExpiresByType image/vnd.microsoft.icon "access plus 1 year"
  ExpiresByType font/woff2               "access plus 1 year"
  ExpiresByType font/woff                "access plus 1 year"
  ExpiresByType application/font-woff2   "access plus 1 year"
</IfModule>

<IfModule mod_headers.c>
  Header unset ETag
</IfModule>
FileETag None

<FilesMatch "^\.|\.env$|\.git">
  Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
  RewriteRule ^config/ - [F,L]
  RewriteRule ^includes/ - [F,L]
</IfModule>
