50 lines
1.8 KiB
ApacheConf
50 lines
1.8 KiB
ApacheConf
RewriteEngine On
|
||
|
||
# If the request is not for a real file or directory
|
||
RewriteCond %{REQUEST_FILENAME} !-f
|
||
RewriteCond %{REQUEST_FILENAME} !-d
|
||
|
||
# Redirect all requests to index.php
|
||
RewriteRule ^(.*)$ index.php [QSA,L]
|
||
|
||
# Prevent directory listing
|
||
Options -Indexes
|
||
|
||
# Set default charset
|
||
AddDefaultCharset UTF-8
|
||
|
||
# ===== 安全加固 =====
|
||
|
||
# 禁止访问敏感文件
|
||
<FilesMatch "\.(env|sql|log|md|yml|yaml|json|lock)$">
|
||
Order allow,deny
|
||
Deny from all
|
||
</FilesMatch>
|
||
|
||
# 禁止直接访问诊断/调试/安装/修复脚本
|
||
<FilesMatch "^(diag|debug_|verify_|php83_check|fix_db|fix_db_password|install|logintest|pwdtest|cachecheck|checkpath|check|hexcheck|dbcheck)\.php$">
|
||
Order allow,deny
|
||
Deny from all
|
||
</FilesMatch>
|
||
|
||
# 禁止访问备份目录（含 backups/ 和 _backup_/）
|
||
<IfModule mod_rewrite.c>
|
||
RewriteRule ^backups/ - [F,L]
|
||
RewriteRule ^_backup_ - [F,L]
|
||
</IfModule>
|
||
|
||
# 安全头
|
||
<IfModule mod_headers.c>
|
||
Header always set X-Content-Type-Options "nosniff"
|
||
Header always set X-Frame-Options "SAMEORIGIN"
|
||
Header always set X-XSS-Protection "1; mode=block"
|
||
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
||
# P2-6 / v3-P2：CSP 已迁移至 index.php 按请求动态生成（含 nonce），此处不再静态设置，
|
||
# 以避免与 PHP 端的 nonce 策略形成「双重 CSP 策略」冲突（浏览器会要求两者同时满足）。
|
||
# 当前 script-src 仍保留 'unsafe-inline' 作为迁移过渡；待全站内联事件处理器
|
||
#（onclick 等）改造为 addEventListener 后，再于 index.php 移除 'unsafe-inline'。
|
||
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
|
||
# 仅 HTTPS 时启用 HSTS（站点已 301 强制 HTTPS，可安全启用）
|
||
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||
</IfModule>
|