Options -Indexes

DirectoryIndex index.php

# Block direct web access to server-side code, private keys, config and storage.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(storage|config|includes)(/|$) - [F,L,NC]
    RewriteRule (^|/)\. - [F,L]
    RewriteRule \.(pem|key|crt|csr|p12|pfx|env|ini|log|sql|sqlite|bak|dist|yml|yaml|jsonl?)$ - [F,L,NC]
</IfModule>


<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /race/
    RewriteRule ^sitemap\.xml$ sitemap.php [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^([a-zA-Z0-9-]+)/?$ index.php?page=$1 [L,QSA]
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json application/xml application/rss+xml image/svg+xml
</IfModule>

<IfModule mod_brotli.c>
    AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType application/pdf "access plus 1 month"
</IfModule>

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=(self)"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Cross-Origin-Resource-Policy "same-origin"
    <FilesMatch "\.(css|js|webp|png|jpg|jpeg|svg|woff2)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    <FilesMatch "\.(html|php)$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>
</IfModule>

<FilesMatch "\.(sql|md|env|jsonl|json|pem|key|crt|csr|p12|pfx)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "\.(bak|config|dist|ini|log|psd|sh|sqlite|swp|yml|yaml)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>



# Block execution of scripts uploaded as attachments.
<IfModule mod_rewrite.c>
    RewriteRule ^assets/uploads/.*\.(php|phtml|phar|cgi|pl|asp|aspx|jsp)$ - [F,L,NC]
</IfModule>
