.htaccess

# Restricted access to files
<FilesMatch "((\.(lock|cache|db))|installed.json|composer.json|package.json|bower.json|CHANGELOG.md|README.md|gulpfile.js|webpack.config.js|pagekit)$">
      # Apache < 2.3
        <IfModule !mod_authz_core.c>
            Order allow,deny
            Deny from all
            Satisfy All
        </IfModule>

        # Apache ≥ 2.3
        <IfModule mod_authz_core.c>
            Require all denied
        </IfModule>
</FilesMatch>

# Don't show directory listings
<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>

# URL rewrites
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Set base if your site is running in a VirtualDocumentRoot
    # RewriteBase /

    # Redirect requests to access the site with the 'www.' prefix
    # RewriteCond %{HTTP_HOST} .
    # RewriteCond %{HTTP_HOST} !^www\. [NC]
    # RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Redirect requests to access the site without the 'www.' prefix
    # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    # RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

    # Redirect requests to access the site with HTTPS
    # RewriteCond %{HTTPS} off
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R]

    # Rewrite request to use the index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]

    <IfModule mod_env.c>
        SetEnv HTTP_MOD_REWRITE On
    </IfModule>

     <IfModule !mod_env.c>
        <IfModule mod_headers.c>
            RequestHeader set MOD_REWRITE "On"
        </IfModule>
     </IfModule>
</IfModule>

# Redirect admin URL, if rewrite is not enabled
<IfModule !mod_rewrite.c>
    <IfModule mod_alias.c>

        RedirectMatch (.*)(?<!index.php)\/admin$ $1/index.php/admin

    </IfModule>
</IfModule>

# Media types
<IfModule mod_mime.c>
    AddType image/svg+xml svg svgz

    <IfModule mod_deflate.c>
        AddEncoding gzip svgz
    </IfModule>
</IfModule>

# Normalize javascript mime type
<IfModule mod_mime.c>
    AddType application/javascript js
</IfModule>

# Compression
<IfModule mod_deflate.c>
    # Force compression for mangled `Accept-Encoding` request headers
    # https://developer.yahoo.com/blogs/ydn/pushing-beyond-gzipping-25601.html
    <IfModule mod_setenvif.c>
        <IfModule mod_headers.c>
            SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
            RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
        </IfModule>
    </IfModule>

    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE "application/javascript" \
                                      "application/json" \
                                      "application/rss+xml" \
                                      "image/bmp" \
                                      "image/svg+xml" \
                                      "image/x-icon" \
                                      "text/css" \
                                      "text/html" \
                                      "text/plain"
    </IfModule>
</IfModule>

# Expire headers
<IfModule mod_expires.c>
    ExpiresActive on
    ExpiresDefault                        "access plus 1 week"

    ExpiresByType application/json        "access plus 0 seconds"
    ExpiresByType application/rss+xml     "access plus 0 seconds"
    ExpiresByType text/html               "access plus 0 seconds"
    ExpiresByType text/plain              "access plus 0 seconds"

    # Use expires far in the future for css and javascript because Pagekit uses filenames to break the cache
    ExpiresByType text/css                "access plus 1 year"
    ExpiresByType application/javascript  "access plus 1 year"
</IfModule>

# Avoid PHP 5.6 deprecated $HTTP_RAW_POST_DATA warnings
<IfModule mod_php5.c>
    php_value always_populate_raw_post_data -1
</IfModule>