.htaccess•2.23 kB
# セキュリティヘッダーの設定
<IfModule mod_headers.c>
# XSS Protection
Header set X-XSS-Protection "1; mode=block"
# Content Security Policy
Header set Content-Security-Policy "default-src 'self' https://cdnjs.cloudflare.com; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data:; font-src 'self' https://cdnjs.cloudflare.com;"
# X-Frame-Options
Header set X-Frame-Options "SAMEORIGIN"
# X-Content-Type-Options
Header set X-Content-Type-Options "nosniff"
# Referrer-Policy
Header set Referrer-Policy "strict-origin-when-cross-origin"
# Permissions-Policy
Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
# HSTS (HTTPSを強制)
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>
# ディレクトリリスティングの無効化
Options -Indexes
# サーバー情報の非表示
ServerSignature Off
# PHPエラーの非表示
php_flag display_errors off
# デフォルトの文字エンコーディング
AddDefaultCharset UTF-8
# ファイルアクセス制限
<FilesMatch "^\.">
Order allow,deny
Deny from all
</FilesMatch>
# 特定のファイルタイプへのアクセス制限
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|bak)$">
Order allow,deny
Deny from all
</FilesMatch>
# MIME Type Security
<IfModule mod_mime.c>
AddType application/javascript .js
AddType text/css .css
AddType image/svg+xml .svg
AddType application/font-woff .woff
AddType application/font-woff2 .woff2
</IfModule>
# Gzip圧縮の有効化
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json
</IfModule>
# ブラウザキャッシュの設定
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
</IfModule>