ServerName toulouse-les-orgues.org ServerAlias www.toulouse-les-orgues.org ServerAdmin webmaster@localhost DocumentRoot /var/www/toulouse # =========================================== # OPTIMISATIONS PERFORMANCE # =========================================== # Compression Gzip (fallback si Brotli indisponible) AddOutputFilterByType DEFLATE text/plain AddOutputFilterByType DEFLATE text/html AddOutputFilterByType DEFLATE text/xml AddOutputFilterByType DEFLATE text/css AddOutputFilterByType DEFLATE text/javascript AddOutputFilterByType DEFLATE application/xml AddOutputFilterByType DEFLATE application/xhtml+xml AddOutputFilterByType DEFLATE application/rss+xml AddOutputFilterByType DEFLATE application/javascript AddOutputFilterByType DEFLATE application/x-javascript AddOutputFilterByType DEFLATE application/json AddOutputFilterByType DEFLATE image/svg+xml # Compression Brotli (prioritaire) AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript AddOutputFilterByType BROTLI_COMPRESS application/x-javascript application/javascript application/json AddOutputFilterByType BROTLI_COMPRESS application/xml application/rss+xml application/atom+xml AddOutputFilterByType BROTLI_COMPRESS application/x-font-ttf application/vnd.ms-fontobject AddOutputFilterByType BROTLI_COMPRESS font/opentype image/svg+xml image/x-icon # Cache et expiration des fichiers statiques ExpiresActive On ExpiresByType image/jpg "access plus 1 year" ExpiresByType image/jpeg "access plus 1 year" ExpiresByType image/gif "access plus 1 year" ExpiresByType image/png "access plus 1 year" ExpiresByType image/webp "access plus 1 year" ExpiresByType text/css "access plus 1 month" ExpiresByType application/pdf "access plus 1 month" ExpiresByType text/javascript "access plus 1 month" ExpiresByType text/x-javascript "access plus 1 month" ExpiresByType application/x-shockwave-flash "access plus 1 month" ExpiresByType image/x-icon "access plus 1 year" ExpiresByType font/woff "access plus 1 year" ExpiresByType font/woff2 "access plus 1 year" ExpiresDefault "access plus 2 days" # Headers de cache Header set Cache-Control "max-age=31536000, public, immutable" Header set Cache-Control "max-age=3600, public" # =========================================== # SECURITE - HEADERS # =========================================== Header always set X-XSS-Protection "1; mode=block" Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; media-src 'self'; object-src 'none'; frame-src 'self' https://www.youtube.com https://youtube.com https://www.youtube-nocookie.com; form-action 'self'; base-uri 'self';" Header always unset X-Powered-By # =========================================== # SSL # =========================================== SSLEngine on SSLCertificateFile /etc/letsencrypt/live/toulouse-les-orgues.org/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/toulouse-les-orgues.org/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 SSLHonorCipherOrder on # =========================================== # DIRECTORY / WORDPRESS # =========================================== Options -Indexes -Includes -ExecCGI AllowOverride All Require all granted # Bloquer PHP uniquement dans uploads Require all denied # Protection des fichiers sensibles Require all denied # Blocage xmlrpc.php (anti brute-force amplifie / pingback DDoS). # WPML retire (2026-06-25) => plus de translationproxy => blocage total sans risque. Require all denied # Bloque l'accès aux fichiers de sauvegarde/dump/temp (jamais du contenu web legitime). # Couvre les .bak laisses par des editions + tout dump SQL expose. Require all denied # =========================================== # REDIRECT www -> non-www (HTTPS) # =========================================== RewriteEngine On RewriteCond %{HTTP_HOST} ^www\.toulouse-les-orgues\.org$ [NC] RewriteRule ^ https://toulouse-les-orgues.org%{REQUEST_URI} [L,NE,R=301] # Logs ErrorLog ${APACHE_LOG_DIR}/toulouse.error.log CustomLog ${APACHE_LOG_DIR}/toulouse.access.log combined # =========================================== # HTTP (port 80) - Redirect to HTTPS + Certbot # =========================================== ServerName toulouse-les-orgues.org ServerAlias www.toulouse-les-orgues.org DocumentRoot /var/www/toulouse RewriteEngine On RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ RewriteRule ^ https://toulouse-les-orgues.org%{REQUEST_URI} [L,NE,R=301] # Securite serveur ServerTokens Prod ServerSignature Off LimitRequestBody 10485760 Timeout 60