# HTTP to HTTPS redirect
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# SECURE HEADERS https://owasp.org/www-project-secure-headers/
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
<IfModule mod_headers.c>
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Frame-Options SAMEORIGIN
Header always set X-Content-Type-Options "nosniff"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set Referrer-Policy: strict-origin-when-cross-origin
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
Header set Content-Security-Policy "upgrade-insecure-requests"
#Header set Content-Security-Policy "default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'"
Header set Feature-Policy "accelerometer 'none'; ambient-light-sensor 'self'; autoplay 'self'; camera 'none'; cookie 'self'; docwrite 'self'; domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'self'; picture-in-picture 'self'; speaker 'self'; sync-script 'self'; sync-xhr 'self'; unsized-media 'self'; usb 'none'; vertical-scroll 'self'; vibrate 'none'; vr 'none'"
Header always set Permissions-Policy "geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);"  
# Permissions-Policy: "accelerometer=(), ambient-light-sensor=(self), autoplay=(self), camera=(), cookie=(self), docwrite=(self), domain=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(self), picture-in-picture=(self), speaker=(self), sync-script=(self), sync-xhr=(self), unsized-media=(self), usb=(), vertical-scroll=(self), vibrate=(), vr=(self)"      
#Header set Permissions-Policy "accelerometer=Origin(), autoplay=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), usb=()"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
Header always set Expect-CT "max-age=7776000, enforce"
Header set Connection keep-alive
</IfModule>

# BEGIN WordPress
# Le direttive (linee) tra "BEGIN WordPress" e "END WordPress" sono
# generate dinamicamente, e dovrebbero essere modificate solo tramite i filtri di WordPress.
# Ogni modifica alle direttive tra questi marcatori verrà sovrascritta.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# NASCONDE INFO INVIATE DAL SERVER
ServerSignature Off
Header unset X-Powered-By

# BLOCCO ACCESSO ALLE CARTELLE DIRECTORIES
Options All -Indexes

# BLOCCO ACCESSO wp-includes 
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/.*\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# BLOCCA SCRIPTS INJECTIONS
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

# PROTEZIONE FILE HTACCESS
<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>

# PROTEZIONE FILE SENSIBILI
<FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|install\.php|php\.info|readme\.html|bb-config\.php|\.htaccess|\.htpasswd|readme\.txt|timthumb\.php|error_log|error\.log|PHP_errors\.log|\.svn)">
Deny from all
</FilesMatch>

# PROTEZIONE RICHIESTE XMLRPC
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

# HIDE WORDPRESS LOGIN PAGE TO EVERYBODY EXCEPT 
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^37\.161\.216\.102$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
</IfModule>

# SCADENZE DEI CACHE-CONTROL HEADERS
<IfModule mod_headers.c>
	<FilesMatch ".(ico|gif|jpg|jpeg|png|svg|pdf|doc|gz)$">
		Header set Cache-Control "max-age=31536000, public, must-revalidate"
	</FilesMatch>
	<FilesMatch ".(txt|xml|js|css)$">
		Header set Cache-Control "max-age=604800, public, must-revalidate"
	</FilesMatch>
	<FilesMatch ".(html|htm|php)$">
		Header set Cache-Control "max-age=86400, must-revalidate"
	</FilesMatch>
</IfModule>

# SCADENZA RISORSE STATICHE (EXPIRES CACHING)
<IfModule mod_expires.c>
    FileETag MTime Size
    AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css application/xml application/xhtml+xml application/rss+xml application/javascript application/x-javascript
    ExpiresActive On
    ExpiresByType text/html "access 600 seconds"
    ExpiresByType application/xhtml+xml "access 600 seconds"
    ExpiresByType text/css "access 1 month"
    ExpiresByType text/javascript "access 1 month"
    ExpiresByType text/x-javascript "access 1 month"
    ExpiresByType application/javascript "access 1 month"
    ExpiresByType application/x-javascript "access 1 month"
    ExpiresByType application/x-shockwave-flash "access 1 month"
    ExpiresByType application/pdf "access 1 month"
    ExpiresByType image/x-icon "access 1 year"
    ExpiresByType image/jpg "access 1 year"  
    ExpiresByType image/jpeg "access 1 year"
    ExpiresByType image/png "access 1 year"
    ExpiresByType image/gif "access 1 year"
    ExpiresDefault "access 1 month"
</IfModule>

# DEFER PARSING OF JAVASCRIPT
<FilesMatch ".css$">
	SetHandler application/x-httpd-php
	Header set Content-type "text/css"
</FilesMatch>
<FilesMatch ".js$">
	SetHandler application/x-httpd-php
	Header set Content-type "application/javascript"
</FilesMatch>

# DISABILITA HOTLINKING IMMAGINI CON OPZIONE FORBIDDEN/CUSTOM IMAGE
RewriteEngine on
#RewriteRule \.(jpg|jpeg|png|gif|svg|bmp)$ https://agendadelvolo.info/images/gravatar.jpg [NC,R,L]

# REDUCE COMMENT SPAM BY BLOCKING NO-REFERRER REQUESTS
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post.php
RewriteCond %{HTTP_USER_AGENT} ^$

# FILE COMPRESSION
<IfModule mod_deflate.c>
	AddOutputFilterByType DEFLATE text/plain text/html text/richtext text/css text/javascript application/json text/xsd text/xsl
	AddOutputFilterByType DEFLATE text/xml text/x-component application/xml application/xhtml+xml application/rss+xml application/atom+xml
	AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/x-httpd-php application/x-httpd-fastphp
	AddOutputFilterByType DEFLATE application/vnd.ms-fontobject application/x-font application/x-font-opentype application/x-font-otf application/x-font-truetype application/x-font-ttf font/opentype font/otf font/ttf
	AddOutputFilterByType DEFLATE image/svg+xml image/x-icon
</IfModule>

# GZIP COMPRESSION
# è fatto a livello server root: "Optimise website" (per i files) e "MultiPHP INI Editor">"php_flag zlib.output_compression" (per il PHP)

# Wordfence WAF
<Files ".user.ini">
<IfModule mod_authz_core.c>
	Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
	Order deny,allow
	Deny from all
</IfModule>
</Files>

# END Wordfence WAF

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?agendadelvolo.info/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?agendadelvolo.info$      [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://checkout.stripe.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://checkout.stripe.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*)?agendadelvolo.info/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*)?agendadelvolo.info$      [NC]
RewriteRule .*\.(.*)$ http://%{REMOTE_ADDR}/$ [R,NC]

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
   php_flag display_errors Off
   php_value max_execution_time 3000
   php_value max_input_time 6000
   php_value max_input_vars 3000
   php_value memory_limit 5000M
   php_value post_max_size 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_value upload_max_filesize 512M
   php_flag zlib.output_compression On
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors Off
   php_value max_execution_time 3000
   php_value max_input_time 6000
   php_value max_input_vars 3000
   php_value memory_limit 5000M
   php_value post_max_size 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_value upload_max_filesize 512M
   php_flag zlib.output_compression On
</IfModule>
# END cPanel-generated php ini directives, do not edit

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit