ht.access

# For full documentation and other suggested options, please see
# http://rtfm.modx.com/evolution/1.0/administration/friendly-url-solutions
# including for unexpected logouts in multi-server/cloud environments
# and especially for the first three commented out rules

#php_flag register_globals Off
AddDefaultCharset utf-8
#php_value date.timezone Europe/Kyiv

# Site address. Links the CMS emails out (password recovery) and its redirects are built from
# the request; a forged Host header must not change them. Two ways to make that so:
#
# 1. Apache config (vhost or server config - these directives are not allowed in .htaccess):
#        ServerName example.com
#        ServerAlias www.example.com
#        UseCanonicalName On
#    PHP then sees SERVER_NAME (and SERVER_PORT) from ServerName whatever Host says, and builds
#    recovery links from them. With UseCanonicalName Off (the default) both follow the request.
#    On a port other than 80/443 name it: "ServerName example.com:8443". This covers recovery
#    links only, and a published port that differs from the one Apache listens on (containers)
#    is lost; the rest of the site URL still follows Host. A catch-all first vhost refusing
#    unknown names helps, but Apache matches vhosts by name only - a Host with the right name
#    and another port still gets through. For the complete address use option 2.
#
# 2. Pin the address list here (or EVO_SITE_HOSTNAMES in core/custom/define.php or .env).
#    It pins the whole site URL, port included: an entry without a port means the default one
#    (80/443), so a site on another port lists it, e.g. example.com:8443. A request for any
#    other address gets the first entry.
#    Precedence: core/custom/define.php, then this (or vhost SetEnv; .htaccess wins over the
#    vhost), then .env. Set it in one place.
#    If you enable a www / non-www redirect below, list the host it redirects to first: the CMS
#    sends a request for an unlisted host to the first entry, and a rule sending it back loops.
#SetEnv EVO_SITE_HOSTNAMES example.com,www.example.com

#Options +FollowSymlinks
RewriteEngine On

# Prevent directory listing
Options -Indexes

# Allow .well-known directory (for SSL, domain verification, etc.) blocking other dotfiles and dotfolders at any level
RewriteRule ^\.well-known/ - [L]
RewriteCond %{REQUEST_URI} (^|/)\. [NC]
RewriteRule .* - [F,L]

RewriteBase /

# Fix Apache internal dummy connections from breaking [(site_url)] cache
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]

#Remove ///// in url
#RewriteCond %{REQUEST_URI} ^(.*)/{2,}(.*)$
#RewriteRule . %1/%2 [R=301,L]

#redirect http to https
#RewriteCond %{HTTP:SSL} !=1 [NC]
#RewriteRule ^(.*) https://%{SERVER_NAME}/$1 [L,R=301]
#or
#RewriteCond %{HTTPS} off
#RewriteRule ^(.*) https://%{HTTP_HOST}%{REQUEST_URI}
#work for litespeed
#RewriteCond %{HTTPS}  !=on
#RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]


# Rewrite domain.com -> www.domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} !^$
#RewriteCond %{HTTP_HOST} !^www\. [NC]
#RewriteCond %{HTTP_HOST} (.+)$
#RewriteRule ^(.*)$ http://www.%1/$1 [R=permanent,L] .

# without www
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^example\.com [NC]
#RewriteRule (.*) http://example.com/$1 [R=301,L]

# without www all domains
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} ^www.(.*)$ [NC]
#RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# 301 that removes index.php?q= from all urls
#RewriteCond %{THE_REQUEST} \s/+index\.php\?&q=([^\s&]+) [NC]
#RewriteRule ^ /%1? [R=301,L]
#RewriteCond %{THE_REQUEST} \s/+index\.php\?q=([^\s&]+) [NC]
#RewriteRule ^ /%1? [R=301,L]

# Paths that must never be reachable over HTTP (mirrors ng.inx).
#   core, views, vendor, tmp          - CMS core (config, .env, storage), Blade layouts, deps, scratch
#   assets/(cache|backup|export|import) - generated and writable areas; the per-directory
#                                       .htaccess files there only work with AllowOverride
#   except assets/cache/images          - phpThumb thumbnails (Helper::phpThumb()), linked from pages:
#                                       existing image files only. REQUEST_FILENAME is the file Apache
#                                       resolved, so a script with PATH_INFO (x.php/y.png) is no image.
RewriteRule ^(core|views|vendor|tmp)(/|$) - [F,L]
RewriteCond %{REQUEST_FILENAME} \.(jpe?g|png|gif|webp|avif|bmp|ico|wbmp)$ [NC]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^assets/cache/images/ - [L]
RewriteRule ^assets/(cache|backup|export|import)(/|$) - [F,L]

# Root-level files that fingerprint the install or describe its layout.
RewriteRule ^(composer\.(json|lock)|phpstan\.neon|publiccode\.yml|AGENTS\.md|README\.md|ht\.access|ng\.inx|config\.php(\.example)?)$ - [F,L]

# Backups, dumps, editor leftovers and PHP include fragments anywhere, including compressed copies.
RewriteRule \.(sql|sqlite|db|log|bak|old|orig|save|swp|swo|tpl|inc|ini|env|dist|example|yml|yaml|lock|tar)(\.(gz|bz2|xz|zip|tgz))?$ - [F,L,NC]

# No PHP execution under assets - uploads live here.
RewriteRule ^assets/.*\.php$ - [F,L,NC]

# Exclude /assets and /manager directories and images from rewrite rules
RewriteRule ^(manager|assets|js|css|images|img)/.*$ - [L]
RewriteRule \.(jpg|jpeg|png|gif|ico)$ - [L]

# For Friendly URLs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

# Reduce server overhead by enabling output compression if supported.
#php_flag zlib.output_compression On
#php_value zlib.output_compression_level 5