# ----------------------------------------------------------------------# Apache configuration file# This file is best used in /apache2/httpd.conf, but works (slower) in .htaccess## I've spent quite a bit of time compiling what I find to be optimial to me# and my server. This file is based on:# - HTML5BoilerPlate: https://github.com/h5bp/html5-boilerplate/# - W3 Edge: http://www.w3-edge.com/# - Yahoo! Best Practices: http://developer.yahoo.com/performance/rules.html# - Caching Tutorial: http://www.mnot.net/cache_docs/# - Personal experience## v1.2 / 2013.07.01 / Greg Rickaby# ----------------------------------------------------------------------# Specify a Default CharsetAddDefaultCharset utf-8# ----------------------------------------------------------------------# Cache Control via HTTP Headers + Expires# Generation of Expires and Cache-Control HTTP headers according to user-specified criteria# http://httpd.apache.org/docs/2.0/mod/mod_headers.html# ----------------------------------------------------------------------# Expires Defaults<IfModule mod_expires.c>ExpiresActive On# Set default expires to 2 daysExpiresDefault A172800ExpiresByType text/css A31536000ExpiresByType application/x-javascript A31536000ExpiresByType text/x-component A31536000ExpiresByType text/html A3600ExpiresByType text/richtext A3600ExpiresByType image/svg+xml A3600ExpiresByType text/plain A3600ExpiresByType text/xsd A3600ExpiresByType text/xsl A3600ExpiresByType text/xml A3600ExpiresByType video/asf A31536000ExpiresByType video/avi A31536000ExpiresByType image/bmp A31536000ExpiresByType application/java A31536000ExpiresByType video/divx A31536000ExpiresByType application/msword A31536000ExpiresByType application/vnd.ms-fontobject A31536000ExpiresByType application/x-msdownload A31536000ExpiresByType image/gif A31536000ExpiresByType application/x-gzip A31536000ExpiresByType image/x-icon A31536000ExpiresByType image/jpeg A31536000ExpiresByType application/vnd.ms-access A31536000ExpiresByType audio/midi A31536000ExpiresByType video/quicktime A31536000ExpiresByType audio/mpeg A31536000ExpiresByType video/mp4 A31536000ExpiresByType video/mpeg A31536000ExpiresByType application/vnd.ms-project A31536000ExpiresByType application/x-font-otf A31536000ExpiresByType application/vnd.oasis.opendocument.database A31536000ExpiresByType application/vnd.oasis.opendocument.chart A31536000ExpiresByType application/vnd.oasis.opendocument.formula A31536000ExpiresByType application/vnd.oasis.opendocument.graphics A31536000ExpiresByType application/vnd.oasis.opendocument.presentation A31536000ExpiresByType application/vnd.oasis.opendocument.spreadsheet A31536000ExpiresByType application/vnd.oasis.opendocument.text A31536000ExpiresByType audio/ogg A31536000ExpiresByType application/pdf A31536000ExpiresByType image/png A31536000ExpiresByType application/vnd.ms-powerpoint A31536000ExpiresByType audio/x-realaudio A31536000ExpiresByType image/svg+xml A31536000ExpiresByType application/x-shockwave-flash A31536000ExpiresByType application/x-tar A31536000ExpiresByType image/tiff A31536000ExpiresByType application/x-font-ttf A31536000ExpiresByType audio/wav A31536000ExpiresByType audio/wma A31536000ExpiresByType application/vnd.ms-write A31536000ExpiresByType application/vnd.ms-excel A31536000ExpiresByType application/zip A31536000</IfModule># No caching for dynamic files<filesMatch "\.(php|cgi|pl|htm)$">ExpiresDefault A0Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"Header set Pragma "no-cache"</filesMatch># 1 MIN<filesMatch "\.(html)$">ExpiresDefault A60Header set Cache-Control "max-age=60, must-revalidate"</filesMatch># 2 DAYS<filesMatch "\.(xml|txt)$">ExpiresDefault A172800Header set Cache-Control "max-age=172800, must-revalidate"</filesMatch># 1 WEEK<filesMatch "\.(jpg|jpeg|png|gif|swf|js|css)$">ExpiresDefault A604800Header set Cache-Control "max-age=604800, must-revalidate"</filesMatch># 1 MONTH<filesMatch "\.(ico|pdf|flv)$">ExpiresDefault A2419200Header set Cache-Control "max-age=2419200, must-revalidate"</filesMatch># ----------------------------------------------------------------------# Mime Types# Mime Associates the requested filename's extensions with the file's behavior and content# http://httpd.apache.org/docs/2.0/mod/mod_mime.html# ----------------------------------------------------------------------<IfModule mod_mime.c>AddType text/css .cssAddType application/x-javascript .jsAddType text/x-component .htcAddType text/html .html .htmAddType text/richtext .rtf .rtxAddType image/svg+xml .svg .svgzAddType text/plain .txtAddType text/xsd .xsdAddType text/xsl .xslAddType text/xml .xmlAddType video/asf .asf .asx .wax .wmv .wmxAddType video/avi .aviAddType image/bmp .bmpAddType application/java .classAddType video/divx .divxAddType application/msword .doc .docxAddType application/vnd.ms-fontobject .eotAddType application/x-msdownload .exeAddType image/gif .gifAddType application/x-gzip .gz .gzipAddType image/x-icon .icoAddType image/jpeg .jpg .jpeg .jpeAddType application/vnd.ms-access .mdbAddType audio/midi .mid .midiAddType video/quicktime .mov .qtAddType audio/mpeg .mp3 .m4aAddType video/mp4 .mp4 .m4vAddType video/mpeg .mpeg .mpg .mpeAddType application/vnd.ms-project .mppAddType application/x-font-otf .otfAddType application/vnd.oasis.opendocument.database .odbAddType application/vnd.oasis.opendocument.chart .odcAddType application/vnd.oasis.opendocument.formula .odfAddType application/vnd.oasis.opendocument.graphics .odgAddType application/vnd.oasis.opendocument.presentation .odpAddType application/vnd.oasis.opendocument.spreadsheet .odsAddType application/vnd.oasis.opendocument.text .odtAddType audio/ogg .oggAddType application/pdf .pdfAddType image/png .pngAddType application/vnd.ms-powerpoint .pot .pps .ppt .pptxAddType audio/x-realaudio .ra .ramAddType application/x-shockwave-flash .swfAddType application/x-tar .tarAddType image/tiff .tif .tiffAddType application/x-font-ttf .ttf .ttcAddType audio/wav .wavAddType audio/wma .wmaAddType application/vnd.ms-write .wriAddType application/vnd.ms-excel .xla .xls .xlsx .xlt .xlwAddType application/zip .zip</IfModule># ----------------------------------------------------------------------# Gzip compression# Compress content before it is delivered to the client# http://httpd.apache.org/docs/2.0/mod/mod_deflate.html# ----------------------------------------------------------------------<IfModule mod_deflate.c># Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/<IfModule mod_setenvif.c><IfModule mod_headers.c>SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-EncodingRequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding</IfModule></IfModule><IfModule filter_module># HTML, TXT, CSS, JavaScript, JSON, XML, HTC:FilterDeclare COMPRESSFilterProvider COMPRESS DEFLATE resp=Content-Type $text/htmlFilterProvider COMPRESS DEFLATE resp=Content-Type $text/cssFilterProvider COMPRESS DEFLATE resp=Content-Type $text/plainFilterProvider COMPRESS DEFLATE resp=Content-Type $text/xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $text/x-componentFilterProvider COMPRESS DEFLATE resp=Content-Type $application/javascriptFilterProvider COMPRESS DEFLATE resp=Content-Type $application/jsonFilterProvider COMPRESS DEFLATE resp=Content-Type $application/xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $application/xhtml+xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $application/rss+xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $application/atom+xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $application/vnd.ms-fontobjectFilterProvider COMPRESS DEFLATE resp=Content-Type $image/svg+xmlFilterProvider COMPRESS DEFLATE resp=Content-Type $image/x-iconFilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-ttfFilterProvider COMPRESS DEFLATE resp=Content-Type $font/opentypeFilterChain COMPRESSFilterProtocol COMPRESS DEFLATE change=yes;byteranges=no</IfModule><IfModule !mod_filter.c># Legacy versions of ApacheAddOutputFilterByType DEFLATE text/html text/plain text/css application/jsonAddOutputFilterByType DEFLATE application/javascriptAddOutputFilterByType DEFLATE text/xml application/xml text/x-componentAddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xmlAddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.ms-fontobject application/x-font-ttf font/opentype</IfModule></IfModule># ----------------------------------------------------------------------# Start rewrite engine# Provides a rule-based rewriting engine to rewrite requested URLs on the fly# http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html# ----------------------------------------------------------------------# FollowSymLinks must be enabled for this to work<IfModule mod_rewrite.c>Options +FollowSymlinksRewriteEngine On</IfModule># Block access to "hidden" directories whose names begin with a period<IfModule mod_rewrite.c>RewriteCond %{SCRIPT_FILENAME} -dRewriteCond %{SCRIPT_FILENAME} -fRewriteRule "(^|/)\." - [F]</IfModule># ----------------------------------------------------------------------# Disable server signature (Security)# Configures the Server HTTP response header# http://httpd.apache.org/docs/2.2/mod/core.html#serversignature# ----------------------------------------------------------------------ServerSignature OffServerTokens Prod# ----------------------------------------------------------------------# Disable directory browsing (Security)# Generates directory indexes, automatically, similar to the Unix ls command or the Win32 dir shell command# http://httpd.apache.org/docs/2.0/mod/mod_autoindex.html# ----------------------------------------------------------------------<IfModule mod_autoindex.c>Options -Indexes</IfModule># ----------------------------------------------------------------------# Block access to backup and source files (Security)# This files may be left by some text/html editors and pose a great security danger# ----------------------------------------------------------------------<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$">Order allow,denyDeny from allSatisfy All</FilesMatch># ----------------------------------------------------------------------# Increase cookie security (Security)# This files may be left by some text/html editors and pose a great security danger# ----------------------------------------------------------------------<IfModule php5_module>php_value session.cookie_httponly true</IfModule># ----------------------------------------------------------------------# Webfont access# Allow access from all domains for webfonts.# ----------------------------------------------------------------------<IfModule mod_headers.c><FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css)$">Header set Access-Control-Allow-Origin "*"</FilesMatch></IfModule># ----------------------------------------------------------------------# Force latest IE rendering engine# ----------------------------------------------------------------------<IfModule mod_headers.c>Header set X-UA-Compatible "IE=Edge,chrome=1"# mod_headers can't match by content-type, but we don't want to this header on everything<FilesMatch "\.(js|css|gif|png|jpe?g|pdf|xml|oga|ogg|m4a|ogv|mp4|m4v|webm|svg|svgz|eot|ttf|otf|woff|ico|webp|appcache|manifest|htc|crx|oex|xpi|safariextz|vcf)$" >Header unset X-UA-Compatible</FilesMatch></IfModule># ----------------------------------------------------------------------# Instructs the proxies to cache two versions of the resource: one compressed, and one uncompressed.# https://developers.google.com/speed/docs/best-practices/caching#LeverageProxyCaching# ----------------------------------------------------------------------<IfModule mod_headers.c><FilesMatch "\.(js|css|xml|gz)$">Header append Vary: Accept-Encoding</FilesMatch></IfModule># ----------------------------------------------------------------------# CORS-enabled images (@crossorigin)# Send CORS headers if browsers request them; enabled by default for images.# http://developer.mozilla.org/en/CORS_Enabled_Image# http://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html# http://hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/# http://wiki.mozilla.org/Security/Reviews/crossoriginAttribute# ----------------------------------------------------------------------<IfModule mod_setenvif.c><IfModule mod_headers.c><FilesMatch "\.(gif|png|jpe?g|svg|svgz|ico|webp)$">SetEnvIf Origin ":" IS_CORSHeader set Access-Control-Allow-Origin "*" env=IS_CORS</FilesMatch></IfModule></IfModule>
