AddDefaultCharset utf-8

# compress text, html, javascript, css, xml:
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript

AddType font/ttf .ttf
AddType font/eot .eot
AddType font/otf .otf
AddType font/woff .woff

DirectoryIndex index.php

<IfModule mod_php5.c>
    php_value register_globals Off
    php_value upload_max_filesize 50M
    php_value max_execution_time 600
    php_value session.gc_maxlifetime 3600000
</IfModule>

<ifModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options: "nosniff"
    #Header unset Content-Security-Policy
    #Header add Content-Security-Policy "default-src 'self' 'unsafe-inline' www.google-analytics.com *.googleapis.com *.gstatic.com; script-src 'self' 'unsafe-inline' www.google-analytics.com *.cloudfront.net *.googleapis.com *.googlecode.com *.google.com;  img-src 'self' data: www.google-analytics.com *.cloudfront.net *.amazonaws.com *.doubleclick.net *.gstatic.com"
    #Header unset X-Content-Security-Policy
    #Header add X-Content-Security-Policy "default-src 'self' 'unsafe-inline' www.google-analytics.com *.googleapis.com *.gstatic.com; script-src 'self' 'unsafe-inline' www.google-analytics.com *.cloudfront.net *.googleapis.com *.googlecode.com *.google.com;  img-src 'self' data: www.google-analytics.com *.cloudfront.net *.amazonaws.com *.doubleclick.net *.gstatic.com"
    #Header unset X-WebKit-CSP
    #Header add X-WebKit-CSP "default-src 'self' 'unsafe-inline' www.google-analytics.com *.googleapis.com *.gstatic.com; script-src 'self' 'unsafe-inline' www.google-analytics.com *.cloudfront.net *.googleapis.com *.googlecode.com *.google.com;  img-src 'self' data: www.google-analytics.com *.cloudfront.net *.amazonaws.com *.doubleclick.net *.gstatic.com"
</ifModule>

<Files ~ "(sql)$">
    Deny from all
</Files>

<Files ~ "install.sh|README|TODO|init.php|common.php|config.php|local.php">
    Deny from all
</Files>

Options -Indexes
RewriteEngine on
Options +FollowSymLinks
RewriteBase /

RewriteRule ^libs/(.*)$ - [F]
RewriteRule ^cron/(.*)$ - [F]
#RewriteRule ^jf/(.*)$ - [F]
RewriteRule ^paybox/(.*)$ - [F]
#RewriteRule ^tests/(.*)$ - [F]
RewriteRule ^templates/(.*)$ - [F]
RewriteRule ^tblHandlers/(.*)$ - [F]
RewriteRule ^tblDefs/(.*)$ - [F]
RewriteRule ^objects/(.*)$ - [F]
RewriteRule ^logs/(.*)$ - [F]
#RewriteRule ^jplugins/(.*)$ - [F]
RewriteRule ^templates/(.*)$ - [F]
RewriteRule ^dump/(.*)$ - [F]

RewriteCond %{HTTP_USER_AGENT} libwww-perl.* 
RewriteRule .* ? [F,L]

#RewriteCond %{HTTPS} off
#RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


#RewriteRule ^index\.php$ - [L]
#RewriteCond %{REQUEST_FILENAME} !-f
#RewriteCond %{REQUEST_FILENAME} !-d
#RewriteRule . /index.php [L]

RewriteRule ^download/ index.php [L,QSA]

RewriteRule \.(css|js|php|jpg|gif|jpeg|png|zip|gz|swf|xml|txt|ttf|woff|woff2|htc|svg|eot|ico|pdf|tgz)$ - [L]
RewriteRule .* index.php [L,QSA]
