Options -Indexes
DirectoryIndex index.html
<FilesMatch "^\.">
Require all denied
</FilesMatch>

<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpeg "access plus 30 days"
ExpiresByType image/png "access plus 30 days"
ExpiresByType image/webp "access plus 30 days"
ExpiresByType image/gif "access plus 30 days"
ExpiresByType text/css "access plus 1 day"
ExpiresByType application/javascript "access plus 1 day"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch "\.(html|php)$">
Header set Cache-Control "no-cache, no-store, must-revalidate"
</FilesMatch>
<FilesMatch "\.(css|js)$">
Header set Cache-Control "public, max-age=86400, must-revalidate"
</FilesMatch>
<FilesMatch "\.(jpg|jpeg|png|webp|gif)$">
Header set Cache-Control "public, max-age=2592000"
</FilesMatch>
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header always set X-Frame-Options "DENY"
Header always set X-Permitted-Cross-Domain-Policies "none"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self'; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://player.vimeo.com; upgrade-insecure-requests"
<FilesMatch "\.pdf$">
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Content-Security-Policy "default-src 'self'; frame-ancestors 'self'"
</FilesMatch>
<FilesMatch "^constitution-file\.php$">
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Content-Security-Policy "default-src 'self'; frame-ancestors 'self'"
</FilesMatch>
Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
</IfModule>

# The storage folder is protected separately, and uploads must never execute
# server-side scripts even if a file is given a misleading extension.



