.htaccess

ServerSignature Off
Options -Indexes -ExecCGI -FollowSymLinks

# Enforce the existing 1 GiB POST ceiling in Apache, including chunked bodies.
# This is only defense in depth; it does not fix PHP's OOM vulnerabilities.
LimitRequestBody 1073741824


<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
    Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
    Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"
    ServerSignature Off
</IfModule>

<FilesMatch "apple-app-site-association">
    ForceType application/json
</FilesMatch>

<ifModule mod_gzip.c>
mod_gzip_on Yes
mod_gzip_dechunk Yes
mod_gzip_item_include file .(html?|css|js|php)$
mod_gzip_item_include handler ^cgi-script$
mod_gzip_item_include mime ^text/.*
mod_gzip_item_include mime ^application/x-javascript.*
mod_gzip_item_exclude mime ^image/.*
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>

<IfModule mod_php.c>
php_flag session.upload_progress.enabled off
php_value memory_limit -1
php_value max_input_nesting_level 32
php_value post_max_size 1G
php_value upload_max_filesize 1G
php_value max_execution_time 600
php_flag display_startup_errors on
php_flag display_errors off
php_flag html_errors on
php_flag log_errors on
php_value error_log  log/http.error
php_value memory_limit 512M
</IfModule>

<IfModule mod_php7.c>
php_flag session.upload_progress.enabled off
php_value memory_limit -1
php_value max_input_nesting_level 32
php_value post_max_size 1G
php_value upload_max_filesize 1G
php_value max_execution_time 600
php_flag display_startup_errors on
php_flag display_errors off
php_flag html_errors on
php_flag log_errors on
php_value error_log  log/http.error
php_value memory_limit 512M
</IfModule>

<IfModule mod_mime.c>
AddType image/svg+xml svg svgz
AddEncoding gzip svgz
</IfModule>

<IfModule mod_dir.c>
DirectoryIndex index.php
</IfModule>

<IfModule mod_alias.c>
    # Right on folder
    RedirectMatch 403 (?i)^.*\/3rdparty\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.css|\.css.map|\.js|\.js.map|\.woff|\.woff2|\.ttf|\.svg).)*$
    RedirectMatch 403 (?i)^((?!plugins).)*\/backup\/.*$

    RedirectMatch 403 (?i)^.*\/core/ajax\/.*\/((?!ajax\.php).)*$
    RedirectMatch 403 (?i)^.*\/core/api\/.*\/((?!\.php).)*$
    RedirectMatch 403 (?i)^.*\/core/class\/.*$
    RedirectMatch 403 (?i)^.*\/core/com\/.*$
    RedirectMatch 403 (?i)^.*\/core/config\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.svg|\.php).)*$
    RedirectMatch 403 (?i)^.*\/core/css\/.*\/((?!\.css|\.css.map|\.woff|\.woff2|\.ttf|\.svg).)*$
    RedirectMatch 403 (?i)^.*\/core/i18n\/.*$
    RedirectMatch 403 (?i)^.*\/core/img\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.svg).)*$
    RedirectMatch 403 (?i)^.*\/core/php\/.*\/((?!\.php).)*$
    RedirectMatch 403 (?i)^.*\/core/js\/.*$
    RedirectMatch 403 (?i)^.*\/core/repo\/.*$
    RedirectMatch 403 (?i)^.*\/core/template\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.css|\.css.map|\.js|\.js.map|\.woff|\.woff2|\.ttf|\.svg).)*$
    RedirectMatch 403 (?i)^.*\/core/themes\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.css|\.css.map|\.js|\.js.map|\.woff|\.woff2|\.ttf|\.svg).)*$

    RedirectMatch 403 (?i)^.*\/data\/.*\/((?!\.m3u8|\.ts|\.jpg|\.jpeg|\.gif|\.webp|\.png|\.mp3|\.mp4|\.aac|\.svg|\.obj|\.mtl|\.woff|\.woff2|\.ttf|\.css|\.pdf|\.css.map|\.js|\.js.map).)*$
    RedirectMatch 403 (?i)^.*\/desktop\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.css|\.css.map|\.woff|\.woff2|\.ttf|\.svg|\.txt).)*$
    RedirectMatch 403 (?i)^.*\/docs\/.*$
    RedirectMatch 403 (?i)^.*\/install\/.*$
    RedirectMatch 403 (?i)^.*\/log\/.*$
    RedirectMatch 403 (?i)^.*\/mobile\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp|\.css|\.css.map|\.woff|\.woff2|\.ttf|\.svg|\.html|\.php).)*$
    RedirectMatch 403 (?i)^.*\/support\/.*$
    RedirectMatch 403 (?i)^.*\/tests\/.*$
    RedirectMatch 403 (?i)^.*\/vendor\/.*$

    # Plugin specific
    RedirectMatch 403 (?i)^.*\/plugin_info\/.*\/((?!\.png|\.jpg|\.jpeg|\.gif|\.webp).)*$
    RedirectMatch 403 (?i)^.*\/ressources\/.*$
    RedirectMatch 403 (?i)^.*\/resources\/.*$
    RedirectMatch 403 (?i)^.*\/data/records\/.*\/((?!\.m3u8|\.mp4|\.ts).)*$
</IfModule>


# Right on file

Order Allow,Deny

# Allow all :

<FilesMatch ".*\.(css|map|js|jpeg|jpg|png|php|html|svg|woff|woff2|ttf|m3u8|ts|ico|gif|webp|mp3|aac|mp4|pdf|txt)$|(apple\-app\-site\-association)$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

<FilesMatch "^$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

<Files robots.txt>
    Order Allow,Deny
    Allow from all
</Files>

# Deny some php file

<Files sick.php>
    Order Allow,Deny
    Deny from all
</Files>

<FilesMatch ".*\.(class|com|config|sample)\.(php)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>