<IfModule mod_headers.c>

[0] Fix | Delete

<IfModule mod_setenvif.c>

[1] Fix | Delete

<IfModule mod_fcgid.c>

[2] Fix | Delete

SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1

[3] Fix | Delete

RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION

[4] Fix | Delete

</IfModule>

[5] Fix | Delete

<IfModule mod_proxy_fcgi.c>

[6] Fix | Delete

SetEnvIfNoCase Authorization "(.+)" HTTP_AUTHORIZATION=$1

[7] Fix | Delete

</IfModule>

[8] Fix | Delete

<IfModule mod_lsapi.c>

[9] Fix | Delete

SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1

[10] Fix | Delete

RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION

[11] Fix | Delete

</IfModule>

[12] Fix | Delete

</IfModule>

[13] Fix | Delete

[14] Fix | Delete

<IfModule mod_env.c>

[15] Fix | Delete

# Add security and privacy related headers

[16] Fix | Delete

[17] Fix | Delete

# Avoid doubled headers by unsetting headers in "onsuccess" table,

[18] Fix | Delete

# then add headers to "always" table: https://github.com/nextcloud/server/pull/19002

[19] Fix | Delete

Header onsuccess unset Referrer-Policy

[20] Fix | Delete

Header always set Referrer-Policy "no-referrer"

[21] Fix | Delete

[22] Fix | Delete

Header onsuccess unset X-Content-Type-Options

[23] Fix | Delete

Header always set X-Content-Type-Options "nosniff"

[24] Fix | Delete

[25] Fix | Delete

Header onsuccess unset X-Download-Options

[26] Fix | Delete

Header always set X-Download-Options "noopen"

[27] Fix | Delete

[28] Fix | Delete

Header onsuccess unset X-Frame-Options

[29] Fix | Delete

Header always set X-Frame-Options "SAMEORIGIN"

[30] Fix | Delete

[31] Fix | Delete

Header onsuccess unset X-Permitted-Cross-Domain-Policies

[32] Fix | Delete

Header always set X-Permitted-Cross-Domain-Policies "none"

[33] Fix | Delete

[34] Fix | Delete

Header onsuccess unset X-Robots-Tag

[35] Fix | Delete

Header always set X-Robots-Tag "none"

[36] Fix | Delete

[37] Fix | Delete

Header onsuccess unset X-XSS-Protection

[38] Fix | Delete

Header always set X-XSS-Protection "1; mode=block"

[39] Fix | Delete

[40] Fix | Delete

SetEnv modHeadersAvailable true

[41] Fix | Delete

</IfModule>

[42] Fix | Delete

[43] Fix | Delete

# Add cache control for static resources

[44] Fix | Delete

<FilesMatch "\.(css|js|svg|gif|png|jpg|ico|wasm|tflite)$">

[45] Fix | Delete

Header set Cache-Control "max-age=15778463"

[46] Fix | Delete

</FilesMatch>

[47] Fix | Delete

[48] Fix | Delete

<FilesMatch "\.(css|js|svg|gif|png|jpg|ico|wasm|tflite)(\?v=.*)?$">

[49] Fix | Delete

Header set Cache-Control "max-age=15778463, immutable"

[50] Fix | Delete

</FilesMatch>

[51] Fix | Delete

[52] Fix | Delete

# Let browsers cache WOFF files for a week

[53] Fix | Delete

<FilesMatch "\.woff2?$">

[54] Fix | Delete

Header set Cache-Control "max-age=604800"

[55] Fix | Delete

</FilesMatch>

[56] Fix | Delete

</IfModule>

[57] Fix | Delete

[58] Fix | Delete

# PHP 7.x

[59] Fix | Delete

<IfModule mod_php7.c>

[60] Fix | Delete

php_value mbstring.func_overload 0

[61] Fix | Delete

php_value default_charset 'UTF-8'

[62] Fix | Delete

php_value output_buffering 0

[63] Fix | Delete

<IfModule mod_env.c>

[64] Fix | Delete

SetEnv htaccessWorking true

[65] Fix | Delete

</IfModule>

[66] Fix | Delete

</IfModule>

[67] Fix | Delete

[68] Fix | Delete

# PHP 8+

[69] Fix | Delete

<IfModule mod_php.c>

[70] Fix | Delete

php_value mbstring.func_overload 0

[71] Fix | Delete

php_value default_charset 'UTF-8'

[72] Fix | Delete

php_value output_buffering 0

[73] Fix | Delete

<IfModule mod_env.c>

[74] Fix | Delete

SetEnv htaccessWorking true

[75] Fix | Delete

</IfModule>

[76] Fix | Delete

</IfModule>

[77] Fix | Delete

[78] Fix | Delete

<IfModule mod_mime.c>

[79] Fix | Delete

AddType image/svg+xml svg svgz

[80] Fix | Delete

AddType application/wasm wasm

[81] Fix | Delete

AddEncoding gzip svgz

[82] Fix | Delete

</IfModule>

[83] Fix | Delete

[84] Fix | Delete

<IfModule mod_dir.c>

[85] Fix | Delete

DirectoryIndex index.php index.html

[86] Fix | Delete

</IfModule>

[87] Fix | Delete

[88] Fix | Delete

<IfModule pagespeed_module>

[89] Fix | Delete

ModPagespeed Off

[90] Fix | Delete

</IfModule>

[91] Fix | Delete

[92] Fix | Delete

<IfModule mod_rewrite.c>

[93] Fix | Delete

RewriteEngine on

[94] Fix | Delete

RewriteCond %{HTTP_USER_AGENT} DavClnt

[95] Fix | Delete

RewriteRule ^$ /remote.php/webdav/ [L,R=302]

[96] Fix | Delete

RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

[97] Fix | Delete

RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L]

[98] Fix | Delete

RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L]

[99] Fix | Delete

RewriteRule ^remote/(.*) remote.php [QSA,L]

[100] Fix | Delete

RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]

[101] Fix | Delete

RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]

[102] Fix | Delete

RewriteRule ^(?:\.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]

[103] Fix | Delete

</IfModule>

[104] Fix | Delete

[105] Fix | Delete

AddDefaultCharset utf-8

[106] Fix | Delete

Options -Indexes

[107] Fix | Delete

#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####

[108] Fix | Delete

[109] Fix | Delete

ErrorDocument 403 [[relativeurl]]/

[110] Fix | Delete

ErrorDocument 404 [[relativeurl]]/

[111] Fix | Delete

[112] Fix | Delete