# ============================================
# REDIRECTION HTTP VERS HTTPS
# ============================================
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>


# BEGIN WordPress
# Les directives (lignes) entre « BEGIN WordPress » et « END WordPress » sont générées
# dynamiquement, et doivent être modifiées uniquement via les filtres WordPress.
# Toute modification des directives situées entre ces marqueurs sera surchargée.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# ============================================
# SECURITE
# ============================================

# Bloquer l'accès direct au wp-config.php
<Files wp-config.php>
    order allow,deny
    deny from all
</Files>

# Bloquer l'accès au fichier .htaccess lui-même
<Files .htaccess>
    order allow,deny
    deny from all
</Files>

# Bloquer l'accès aux fichiers sensibles
<FilesMatch "\.(log|sql|bak|old|orig|tmp)$">
    order allow,deny
    deny from all
</FilesMatch>

# Désactiver l'affichage du contenu des dossiers
Options -Indexes

# Bloquer l'injection via les variables globales
Options +FollowSymLinks
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\|%7C) [NC]
    RewriteRule .* index.php [F,L]
</IfModule>

# Bloquer les user-agents malveillants courants
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Protéger xmlrpc.php (vecteur d'attaque brute force)
<Files xmlrpc.php>
    order allow,deny
    deny from all
</Files>

# Bloquer l'accès à wp-login.php depuis des IPs inconnues (optionnel)
# <Files wp-login.php>
#     order allow,deny
#     allow from TON_IP
#     deny from all
# </Files>

# En-têtes de sécurité HTTP
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';"
</IfModule>

# Limite la taille des requêtes (anti flood)
LimitRequestBody 10485760

# BEGIN seraphinite-accelerator
# Les directives (lignes) entre « BEGIN seraphinite-accelerator » et « END seraphinite-accelerator » sont générées
# dynamiquement, et doivent être modifiées uniquement via les filtres WordPress.
# Toute modification des directives situées entre ces marqueurs sera surchargée.
<IfModule mod_mime.c>
	AddType image/avif .avif
	AddType image/webp .webp
	AddType application/font-woff2 .woff2
	AddType application/x-font-opentype .otf
</IfModule>
<IfModule mod_expires.c>
	ExpiresActive on
	ExpiresByType text/css                      "access plus 525600 minutes"
	ExpiresByType text/javascript               "access plus 525600 minutes"
	ExpiresByType application/javascript        "access plus 525600 minutes"
	ExpiresByType application/x-javascript      "access plus 525600 minutes"
	ExpiresByType font/eot                      "access plus 525600 minutes"
	ExpiresByType font/opentype                 "access plus 525600 minutes"
	ExpiresByType font/woff                     "access plus 525600 minutes"
	ExpiresByType application/vnd.ms-fontobject "access plus 525600 minutes"
	ExpiresByType application/font-woff         "access plus 525600 minutes"
	ExpiresByType application/font-woff2        "access plus 525600 minutes"
	ExpiresByType application/x-font-ttf        "access plus 525600 minutes"
	ExpiresByType application/x-font-woff       "access plus 525600 minutes"
	ExpiresByType image/vnd.microsoft.icon      "access plus 525600 minutes"
	ExpiresByType image/x-icon                  "access plus 525600 minutes"
	ExpiresByType image/bmp                     "access plus 525600 minutes"
	ExpiresByType image/gif                     "access plus 525600 minutes"
	ExpiresByType image/jpeg                    "access plus 525600 minutes"
	ExpiresByType image/png                     "access plus 525600 minutes"
	ExpiresByType image/svg+xml                 "access plus 525600 minutes"
	ExpiresByType image/avif                    "access plus 525600 minutes"
	ExpiresByType image/webp                    "access plus 525600 minutes"
	ExpiresByType audio/ogg                     "access plus 525600 minutes"
	ExpiresByType video/mp4                     "access plus 525600 minutes"
	ExpiresByType video/ogg                     "access plus 525600 minutes"
	ExpiresByType video/webm                    "access plus 525600 minutes"
</IfModule>
<IfModule mod_headers.c>
	Header unset ETag
</IfModule>
FileETag None
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_URI}?%{QUERY_STRING} \.(jpe|jpg|jpeg|png|gif|bmp|webp|avif)\?(|.*\&)seraph_accel_ai=([\w\-]+)\.([\w\-]+)(\&.*$|$) [NC]
	RewriteCond "/home/gzcsbqa/www/lafromageriebriancon.fr/wp-content/cache/seraphinite-accelerator/s/%3/ai/%4.%1" -f
	RewriteRule . /wp-content/cache/seraphinite-accelerator/s/%3/ai/%4.%1?%2%5 [L]
</IfModule>
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_URI}?%{QUERY_STRING} ([^?]+\.(jpe|jpg|jpeg|png|gif|bmp|webp|avif))\?(|.*\&)seraph_accel_ai=([\w\-]+)\.([\w\-]+)(\&[^\s]*) [NC]
	RewriteCond "/home/gzcsbqa/www/lafromageriebriancon.fr/wp-content/cache/seraphinite-accelerator/s/%4/ai/%5.%2" !-f
	RewriteRule . /?seraph_accel_gi=%1&ai=%4.%5&intrnl=%4&%3%6 [L,R=302]
</IfModule>
<IfModule mod_headers.c>
	<FilesMatch \.(jpe|jpg|jpeg|png|gif|bmp|webp|avif)$>
		Header merge Vary Accept
	</FilesMatch>
</IfModule>
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{HTTP_ACCEPT} image\/webp
	RewriteCond %{REQUEST_FILENAME} \.(jpe|jpg|jpeg|png|gif|bmp|webp|avif)$
	RewriteCond %{REQUEST_FILENAME}.webp -f
	RewriteRule ^(.*)\.(jpe|jpg|jpeg|png|gif|bmp|webp|avif)$ $1\.$2\.webp [QSA]
</IfModule>
<IfModule mod_headers.c>
	<FilesMatch \.(jpe|jpg|jpeg|png|gif|bmp|webp|avif)\.webp$>
		Header merge Vary Accept
	</FilesMatch>
</IfModule>
<IfModule mod_deflate.c>
	<IfModule mod_filter.c>
		AddOutputFilterByType DEFLATE text/plain text/css text/javascript application/javascript application/x-javascript application/json text/html text/xml application/atom+xml application/rss+xml application/xhtml+xml application/xml text/x-component application/vnd.ms-fontobject application/x-font-ttf font/eot font/opentype image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon
	</IfModule>
</IfModule>
<IfModule mod_headers.c>
	<IfModule mod_rewrite.c>
		RewriteEngine On
		RewriteCond %{HTTP:Accept-Encoding} (^|\W)gzip(\W|$)
		RewriteCond %{REQUEST_FILENAME} \.(css|js)$
		RewriteCond %{REQUEST_FILENAME}.gz -f
		RewriteRule ^(.*)\.(css|js)$ $1\.$2\.gz [QSA]
		RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1,E=no-brotli:1]
		RewriteRule \.js\.gz$ - [T=application/javascript,E=no-gzip:1,E=no-brotli:1]
	</IfModule>
	<FilesMatch \.(js|css)\.gz$>
		Header set Content-Encoding gzip
		Header merge Vary Accept-Encoding
	</FilesMatch>
</IfModule>
# END seraphinite-accelerator