.htaccess

# Options not set in httpd.conf
# ------------------------------------------------
Options +FollowSymlinks -Indexes

# Compress the compressables
# ------------------------------------------------
<IfModule mod_deflate.c>

    # Force compression for mangled headers.
    # https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html
    <IfModule mod_setenvif.c>
        <IfModule mod_headers.c>
            SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
            RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
        </IfModule>
    </IfModule>

    # Compress all output labeled with one of the following MIME-types
    # (for Apache versions below 2.3.7, you don't need to enable `mod_filter`
    #  and can remove the `<IfModule mod_filter.c>` and `</IfModule>` lines
    #  as `AddOutputFilterByType` is still in the core directives).
    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE application/atom+xml \
                                      application/javascript \
                                      application/json \
                                      application/rss+xml \
                                      application/vnd.ms-fontobject \
                                      application/x-font-ttf \
                                      application/x-web-app-manifest+json \
                                      application/xhtml+xml \
                                      application/xml \
                                      font/opentype \
                                      image/svg+xml \
                                      image/x-icon \
                                      text/css \
                                      text/html \
                                      text/plain \
                                      text/x-component \
                                      text/xml
    </IfModule>
</IfModule>

# Restrict certain files
# ------------------------------------------------
<FilesMatch "README\.md|composer\.json|composer\.lock|package\.json|^config/*|\.gitignore|gulpfile\.js|build\.sh|phpunit\.xml">
    Require all denied
</FilesMatch>

# Rewriting magic.
# ------------------------------------------------
RewriteEngine on

# Force HTTPS
# ------------------------------------------------
#RewriteCond %{HTTPS} !on
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Note: It’s also recommended to enable HTTP Strict Transport Security (HSTS)
# on your HTTPS website to help prevent man-in-the-middle attacks.
# See https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
#<IfModule mod_headers.c>
#    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
#</IfModule>

# Force www
# ------------------------------------------------
#RewriteCond %{HTTP_HOST} !^$
#RewriteCond %{HTTP_HOST} !^www\. [NC]
#RewriteCond %{HTTPS}s ^on(s)|
#RewriteRule ^ http%1://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Force NON-www
# ------------------------------------------------
#RewriteCond %{HTTP_HOST} ^www\.
#RewriteCond %{HTTPS}s ^on(s)|off
#RewriteCond http%1://%{HTTP_HOST} ^(https?://)(www\.)?(.+)$
#RewriteRule ^ %1%3%{REQUEST_URI} [R=301,L]

# Enforce a no-trailing-slash policy
# ------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)/$ /$1 [R=301,L]

# Enforce a trailing-slash policy
# ------------------------------------------------
#RewriteCond %{REQUEST_FILENAME} !-f
#RewriteRule ^(.*[^/])$ /$1/ [R=301,L]

# Block useragent libwww-perl to discourage simpler vulnerability scans
# ------------------------------------------------
RewriteCond %{HTTP_USER_AGENT} libwww-perl.*
RewriteRule .* – [F,L]

# Nails Front Controller
# Unless requesting a valid file send to index.php
# ------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L]