# Send every request that is not a real file to index.php; block hidden files and PHP files other than index.php.
Options -Indexes
RewriteEngine On
# Send every visitor to https:// — remove the # from the three lines below once the SSL certificate works
# (cPanel → SSL/TLS Status). The smoke test reminds you.
# RewriteCond %{HTTPS} off
# RewriteCond %{HTTP:X-Forwarded-Proto} !https
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteRule (^|/)\. - [F]
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} !\.php$
RewriteRule ^ - [L]
RewriteRule ^ index.php [L,QSA]
<FilesMatch "^(?!index\.php$).*\.php$">
  Require all denied
</FilesMatch>
# Fonts are served with the right type
AddType font/woff2 .woff2
# Compress text (pages, styles, scripts) when the host supports it
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml text/plain
</IfModule>
# Styles, scripts and fonts are cached by browsers for a year (their addresses change when they change)
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
</IfModule>
