# Front page
DirectoryIndex index.html index.php
Options -Indexes

# Pass the Authorization header through to PHP (some hosts drop it)
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP:Authorization} .
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# Never serve the schema, logs or config backups
<FilesMatch "\.(sql|log|bak|md)$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  <FilesMatch "\.(css|js|svg|png|jpg|woff2)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
  <FilesMatch "\.(json)$">
    Header set Cache-Control "public, max-age=3600"
  </FilesMatch>
  # The alert worker and the language list must always be fresh
  <FilesMatch "^(sw\.js|index\.json)$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
</IfModule>
