formq/.htaccess at main · schurrerpame/formq · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# ============================================================
# FORMQ — .htaccess Security Configuration
# formq.app
# ============================================================

# ── FORZAR HTTPS ──────────────────────────────────────────
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ── SEGURIDAD DE HEADERS ──────────────────────────────────
<IfModule mod_headers.c>

  # Evita que el sitio sea embebido en iframes (anti-clickjacking)
  Header always set X-Frame-Options "DENY"

  # Evita que el navegador adivine el tipo de contenido
  Header always set X-Content-Type-Options "nosniff"

  # Activa protección XSS en navegadores legacy
  Header always set X-XSS-Protection "1; mode=block"

  # Fuerza HTTPS por 1 año (HSTS)
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

  # Controla qué información se envía al hacer click en links
  Header always set Referrer-Policy "strict-origin-when-cross-origin"

  # Permisos del navegador — desactiva lo que no usamos
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"

  # Content Security Policy — solo permite recursos autorizados
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://*.supabase.co https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://*.supabase.co wss://*.supabase.co; img-src 'self' data:; frame-ancestors 'none';"

  # Oculta la versión de Apache
  Header always unset X-Powered-By
  Header always unset Server

</IfModule>

# ── OCULTAR ARCHIVOS SENSIBLES ────────────────────────────
<FilesMatch "^\.">
  Order allow,deny
  Deny from all
</FilesMatch>

# Bloquea archivos de entorno y git
<FilesMatch "(\.(env|git|gitignore)|package\.json|composer\.json)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# ── PREVENIR LISTADO DE DIRECTORIOS ───────────────────────
Options -Indexes

# ── PROTECCIÓN CONTRA ATAQUES COMUNES ─────────────────────
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Bloquea strings maliciosos en la URL
  RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
  RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
  RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
  RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
  RewriteCond %{QUERY_STRING} (\.\./|\.\.%2F) [OR]
  RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|update).* [NC]
  RewriteRule .* - [F,L]

  # Bloquea user agents maliciosos conocidos
  RewriteCond %{HTTP_USER_AGENT} (havij|nikto|sqlmap|nessus|masscan) [NC]
  RewriteRule .* - [F,L]

</IfModule>

# ── COMPRESIÓN GZIP ───────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
</IfModule>

# ── CACHÉ DE ASSETS ESTÁTICOS ─────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType text/html "access plus 1 hour"
</IfModule>

# ── PÁGINA DE ERROR PERSONALIZADA ─────────────────────────
ErrorDocument 404 /index.html
ErrorDocument 403 /index.html