Update .htaccess

Author: bkader

src/public/content/.htaccess

@@ -1,89 +1,80 @@
 # ------------------------------------------
-# 🔒 Disable PHP execution for security
+# 🔒 Static content hardening
 # ------------------------------------------
-<FilesMatch "\.(php|php[0-9]*)$">
-	Order allow,deny
-	Deny from all
+
+Options -Indexes
+
+# Disable PHP-like execution/access in static content directory.
+<FilesMatch "\.(?:php|phtml|phar|php[0-9]*)$">
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+	<IfModule !mod_authz_core.c>
+		Order allow,deny
+		Deny from all
+	</IfModule>
 </FilesMatch>
 
-# Alternative: Serve PHP files as plain text (uncomment if preferred)
-# <FilesMatch "\.(php|php[0-9]*)$">
-#  SetHandler none
-#  ForceType text/plain
-# </FilesMatch>
+# Prevent this static host from setting cookies.
+# Note: this does not stop parent-domain cookies from being sent here.
+<IfModule mod_headers.c>
+	Header always unset Set-Cookie
+</IfModule>
 
 # ------------------------------------------
-# 🚀 Enable browser caching for static files
+# 🚀 Browser caching
 # ------------------------------------------
 <IfModule mod_expires.c>
 	ExpiresActive On
 
-	# Set long expiration for common static file types
 	ExpiresByType image/jpg "access plus 1 year"
 	ExpiresByType image/jpeg "access plus 1 year"
 	ExpiresByType image/gif "access plus 1 year"
 	ExpiresByType image/png "access plus 1 year"
+	ExpiresByType image/webp "access plus 1 year"
+	ExpiresByType image/avif "access plus 1 year"
 	ExpiresByType image/svg+xml "access plus 1 year"
+
 	ExpiresByType text/css "access plus 1 month"
 	ExpiresByType text/javascript "access plus 1 month"
 	ExpiresByType application/javascript "access plus 1 month"
 	ExpiresByType application/x-javascript "access plus 1 month"
+
 	ExpiresByType application/font-woff2 "access plus 1 year"
 	ExpiresByType application/font-woff "access plus 1 year"
 	ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
+	ExpiresByType font/woff2 "access plus 1 year"
+	ExpiresByType font/woff "access plus 1 year"
 	ExpiresByType font/ttf "access plus 1 year"
 	ExpiresByType font/otf "access plus 1 year"
 </IfModule>
 
 # ------------------------------------------
-# 💨 Enable GZIP compression
+# 💨 Compression
 # ------------------------------------------
 <IfModule mod_deflate.c>
 	AddOutputFilterByType DEFLATE text/plain
 	AddOutputFilterByType DEFLATE text/html
 	AddOutputFilterByType DEFLATE text/xml
 	AddOutputFilterByType DEFLATE text/css
+	AddOutputFilterByType DEFLATE text/javascript
 	AddOutputFilterByType DEFLATE application/javascript
-	AddOutputFilterByType DEFLATE application/x-javascript
 	AddOutputFilterByType DEFLATE application/json
 	AddOutputFilterByType DEFLATE application/xml
-	AddOutputFilterByType DEFLATE application/font-woff2
-	AddOutputFilterByType DEFLATE application/font-woff
-	AddOutputFilterByType DEFLATE font/ttf
-	AddOutputFilterByType DEFLATE font/otf
+	AddOutputFilterByType DEFLATE image/svg+xml
 
-	# Optional: compress everything except images
-	SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
+	# Do not gzip already-compressed binary assets.
+	SetEnvIfNoCase Request_URI "\.(?:gif|jpe?g|png|webp|avif|ico|woff2?|ttf|otf|eot)$" no-gzip dont-vary
 </IfModule>
 
 # ------------------------------------------
-# 🎯 Leverage cache-control headers
+# 🎯 Cache-Control and security headers
 # ------------------------------------------
 <IfModule mod_headers.c>
-	<FilesMatch "\.(ico|jpg|jpeg|png|gif|svg|css|js|woff|woff2|ttf|otf|eot)$">
+	<FilesMatch "\.(?:ico|jpg|jpeg|png|gif|webp|avif|svg|css|js|map|woff|woff2|ttf|otf|eot)$">
 		Header set Cache-Control "public, max-age=31536000, immutable"
 	</FilesMatch>
-</IfModule>
 
-# ------------------------------------------
-# 🛡️ Basic security headers
-# ------------------------------------------
-<IfModule mod_headers.c>
 	Header set X-Content-Type-Options "nosniff"
-	Header set X-Frame-Options "SAMEORIGIN"
-	Header set X-XSS-Protection "1; mode=block"
 	Header always set Referrer-Policy "strict-origin-when-cross-origin"
 </IfModule>
-
-# ------------------------------------------
-# 🔍 Optional: Redirect to HTTPS if not already handled globally
-# ------------------------------------------
-# RewriteEngine On
-# RewriteCond %{HTTPS} off
-# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
-
-# ------------------------------------------
-# 🧼 Optional: Remove trailing slashes
-# ------------------------------------------
-# RewriteCond %{REQUEST_FILENAME} !-d
-# RewriteRule ^(.+)/$ /$1 [R=301,L]