# Simple Easy Adaptable Shop: Apache config for the web root.
# Every request that is not a real file goes to index.php, which keeps the old WordPress URLs.

Options -Indexes -MultiViews
DirectoryIndex index.php
AddDefaultCharset utf-8
ErrorDocument 403 /index.php

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# HTTPS only, and no www.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

# Never serve code, data or private files directly.
RewriteRule ^(private|lib|templates|tools|exports|data|docs)(/|$) - [F,L]
RewriteRule (^|/)\. - [F,L]
RewriteRule ^(config\.example\.php|[A-Za-z_-]+\.md|LICENSE|urls\.csv)$ - [F,L]
RewriteRule ^wp-content/uploads/.*\.(php|phtml|phar)$ - [F,L]

# The WordPress sitemap and robots are generated by index.php.
RewriteRule ^(sitemap\.xml|robots\.txt|wp-sitemap.*\.xml|sitemap_index\.xml)$ index.php [L]

# Everything that is not a real file goes to the front controller.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
# Folders that exist (e.g. /wp-content/) but have no index: also the front controller.
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(wp-content|wp-content/uploads|images|assets)/?$ index.php [L]
</IfModule>

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
# Our own files plus PayPal (Session 3). Inline style attributes are allowed (page content uses them);
# inline scripts are not, except JSON-LD which browsers do not execute.
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://www.paypal.com https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src https://*.paypal.com https://*.paypalobjects.com; font-src 'self'; form-action 'self' https://*.paypal.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'"
</IfModule>

# Browser caching: assets have ?v= in their URL, photos rarely change.
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType text/css "access plus 1 year"
ExpiresByType application/javascript "access plus 1 year"
ExpiresByType font/woff2 "access plus 1 year"
ExpiresByType image/webp "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
</IfModule>
AddType font/woff2 .woff2

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/css application/javascript application/xml text/plain image/svg+xml
</IfModule>

# ---------------------------------------------------------------------------
# Test site only: password protection.
# Create the password file with your host's control panel ("Password protect directories")
# or: htpasswd -c /home/<user>/private/.htpasswd shop
# then remove the # in front of the 4 lines below. Never upload these lines to the live site.
#AuthType Basic
#AuthName "Test shop"
#AuthUserFile /home/<user>/private/.htpasswd
#Require valid-user
