Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Force HTTPS (disable only on a local development machine)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

<FilesMatch "^\.">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" "expr=%{HTTPS} == 'on'"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "no-referrer"
  Header unset X-Powered-By
  <FilesMatch "\.(css|js|woff2|png)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
</IfModule>

<IfModule mod_php.c>
  php_flag display_errors Off
  php_flag expose_php Off
  php_value upload_max_filesize 16M
  php_value post_max_size 20M
  php_flag session.cookie_httponly On
</IfModule>
