.htaccess

# Kirby .htaccess

Options -Indexes

# Rewrite rules

<IfModule mod_rewrite.c>

RewriteEngine on

# Redirect legacy domain links
RewriteCond %{HTTP_HOST} !^newtonglossary.com$ [NC]
# RewriteRule ^(.*)$ https://newtonglossary.com/$1 [L,R=301]

# Forced SSL
# RewriteCond %{HTTPS} !=on
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

# Block files and folders beginning with a dot, such as .git
# Except for the .well-known folder, which is used for Let’s Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# Block all files in the content folder from being accessed directly
RewriteRule ^content/(.*) index.php [L]

# Block all files in the site folder from being accessed directly
RewriteRule ^site/(.*) index.php [L]

# Block direct access to Kirby and the Panel sources
RewriteRule ^kirby/(.*) index.php [L]

# Make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# Pass the Authorization header to PHP
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# Compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

# Set security headers in all responses
<IfModule mod_headers.c>

# Serve files as plain text if the actual content type is not known
# Hardens against attacks from malicious file uploads
Header set Content-Type "text/plain" "expr=-z %{CONTENT_TYPE}"
Header set X-Content-Type-Options "nosniff"

</IfModule>