.htaccess

DirectoryIndex index.php index.html .ht

<FilesMatch "^composer|^COPYING|^\.env|^\.maintenance|^Procfile|^app\.json|^gulpfile\.js|^package\.json|^package-lock\.json|web\.config|^Dockerfile|^\.editorconfig|\.(ini|lock|dist|git|sh|bak|swp|env|twig|yml|yaml|dockerignore|sample)$">
    order allow,deny
    deny from all
</FilesMatch>

<Files ~ "index.php">
    order deny,allow
    allow from all
</Files>

<IfModule mod_headers.c>
    # クリックジャッキング対策
    Header always set X-Frame-Options SAMEORIGIN

    # XSS対策
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options nosniff
</IfModule>

# デザインテンプレートを適用するため10Mで設定 
<IfModule mod_php7.c>
    php_value upload_max_filesize 10M
</IfModule>

<IfModule mod_rewrite.c>
    #403 Forbidden対応方法
    #ページアクセスできない時シンボリックリンクが有効になっていない可能性あります、
    #オプションを追加してください
    #Options +FollowSymLinks +SymLinksIfOwnerMatch

    RewriteEngine On

    # Authorization ヘッダが取得できない環境への対応
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

    RewriteRule "^\.git" - [F]
    RewriteRule "^src/" - [F]
    RewriteRule "^app/" - [F]
    RewriteRule "^tests/" - [F]
    RewriteRule "^var/" - [F]
    RewriteRule "^vendor/" - [F]
    RewriteRule "^node_modules/" - [F]
    RewriteRule "^gulp/" - [F]
    RewriteRule "^codeception/" - [F]
    RewriteRule "^bin/" - [F]
    RewriteRule "^dockerbuild/" - [F]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !^(.*)\.(gif|png|jpe?g|css|ico|js|svg|map)$ [NC]
    RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

# 管理画面へのBasic認証サンプル
#
# AuthType Basic
# AuthName "Please enter username and password"
# AuthUserFile /path/to/.htpasswd
# AuthGroupFile /dev/null
# require valid-user
#
# SetEnvIf Request_URI "^/admin" admin_path  # ^/adminは, 管理画面URLに応じて変更してください
# <RequireAll>
#     Require all granted
#     Require not env admin_path
# </RequireAll>