fuzzyworld

fuzzyworld-tools / files / server / site-blog / htaccess

htaccess

Blame: the commit that last changed each line · file · history

0e603cf7 2026-10-31 Pavel Safronov1# writing.fuzzyworld.net. blog.py writes this file as .htaccess, followed by the redirects it generates.
2Options -Indexes -Includes -ExecCGI
3DirectoryIndex index.html index.xml
4ErrorDocument 404 /404.html
5
6RewriteEngine On
7# www.<site> -> <site>, keeping path and query.
8RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
9RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
10
11# Nothing in this tree is ever executed: pages are pre-generated HTML and media are images and the like.
12RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .shtml .cgi .pl .py
13RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar
14<FilesMatch "\.(php\d?|phtml|phar|shtml|cgi|pl|py|sh)$">
15 Require all denied
16</FilesMatch>
17
18# The only index.xml is the Atom feed (/feed/index.xml, served at /feed/).
19<FilesMatch "^index\.xml$">
20 ForceType application/atom+xml
21</FilesMatch>
22
e9fdc5db 2026-11-01 Pavel Safronov23# Reader comments, written by the server as /_comments/<post path>.json (never part of the build).
24<FilesMatch "\.json$">
25 ForceType application/json
26</FilesMatch>
27
0e603cf7 2026-10-31 Pavel Safronov28<IfModule mod_headers.c>
29 Header always set Content-Security-Policy "default-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-src 'none'; frame-ancestors 'none'"
30 Header always set X-Content-Type-Options nosniff
31 Header always set Referrer-Policy strict-origin-when-cross-origin
32 # Pages change when the blog is rebuilt: browsers revalidate (cheap 304 when unchanged).
33 <FilesMatch "\.(html|css|js|xml)$">
34 Header set Cache-Control "no-cache"
35 </FilesMatch>
e9fdc5db 2026-11-01 Pavel Safronov36 <FilesMatch "\.json$">
37 Header set Cache-Control "no-cache"
38 </FilesMatch>
0e603cf7 2026-10-31 Pavel Safronov39</IfModule>