mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-07 03:29:19 +02:00
37 lines
973 B
ApacheConf
37 lines
973 B
ApacheConf
# Security headers
|
|
<IfModule mod_headers.c>
|
|
# Prevent clickjacking
|
|
Header always set X-Frame-Options "SAMEORIGIN"
|
|
|
|
# Prevent MIME type sniffing
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
|
|
# Enable XSS protection
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
|
|
# Referrer policy
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
|
|
# Content Security Policy (adjust as needed)
|
|
Header always set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
|
|
</IfModule>
|
|
|
|
# Prevent directory listing
|
|
Options -Indexes
|
|
|
|
# Protect sensitive files
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
<FilesMatch "(composer\.(json|lock)|error\.log)$">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
# PHP security settings (if .htaccess can override)
|
|
<IfModule mod_php.c>
|
|
php_flag display_errors Off
|
|
php_flag log_errors On
|
|
php_value error_log error.log
|
|
</IfModule>
|