diff --git a/README.md b/README.md index 081cc10..ecf6c91 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,13 @@ -# [H5BP](http://h5bp.github.com) Server Configs +# [H5BP](http://h5bp.github.com)'s Server Configs *Best-practice server configurations* to help improve site performance. -* **Apache** -* **node.js** -* **IIS 7+** -* **IIS 6** - see `iis/IIS6-README.md` -* **nginx** -* **lighttpd** -* **Google AppEngine** +* **[Apache](https://github.com/h5bp/server-configs/tree/master/apache)** +* **[Google App Engine](https://github.com/h5bp/server-configs/tree/master/gae)** +* **[IIS 7+](https://github.com/h5bp/server-configs/tree/master/iis)** / **[IIS +6](https://github.com/h5bp/server-configs/blob/master/iis/IIS6-README.md)** +* **[lighttpd](https://github.com/h5bp/server-configs/tree/master/lighttpd)** +* **[nginx](https://github.com/h5bp/server-configs/tree/master/nginx)** +* **[Node.js](https://github.com/h5bp/node-server-config)** Please refer to the README's in each directory for more information. diff --git a/apache/.htaccess b/apache/.htaccess index c0b9a24..7290b3c 100644 --- a/apache/.htaccess +++ b/apache/.htaccess @@ -31,7 +31,7 @@ - + SetEnvIf Origin ":" IS_CORS Header set Access-Control-Allow-Origin "*" env=IS_CORS @@ -86,13 +86,12 @@ Options -MultiViews # Force IE to render pages in the highest available mode in the various # cases when it may not: http://hsivonen.iki.fi/doctype/ie-mode.pdf. -# Use, if installed, Google Chrome Frame. - Header set X-UA-Compatible "IE=edge,chrome=1" + Header set X-UA-Compatible "IE=edge" # `mod_headers` can't match based on the content-type, however, we only # want to send this header for HTML pages and not for the other resources - + Header unset X-UA-Compatible @@ -253,6 +252,8 @@ AddDefaultCharset utf-8 # # RewriteCond %{HTTPS} !=on # RewriteCond %{HTTP_HOST} !^www\..+$ [NC] +# RewriteCond %{HTTP_HOST} !=localhost [NC] +# RewriteCond %{HTTP_HOST} !=127.0.0.1 # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] # @@ -279,7 +280,7 @@ AddDefaultCharset utf-8 # # Header set Content-Security-Policy "script-src 'self'; object-src 'self'" -# +# # Header unset Content-Security-Policy # # @@ -333,19 +334,25 @@ AddDefaultCharset utf-8 # RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L] # -# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# ------------------------------------------------------------------------------ +# | HTTP Strict Transport Security (HSTS) | +# ------------------------------------------------------------------------------ # Force client-side SSL redirection. -# If a user types "example.com" in his browser, the above rule will redirect him -# to the secure version of the site. That still leaves a window of opportunity -# (the initial HTTP connection) for an attacker to downgrade or redirect the -# request. The following header ensures that browser will ONLY connect to your -# server via HTTPS, regardless of what the users type in the address bar. +# If a user types "example.com" in his browser, the above rule will redirect +# him to the secure version of the site. That still leaves a window of oppor- +# tunity (the initial HTTP connection) for an attacker to downgrade or redirect +# the request. The following header ensures that browser will ONLY connect to +# your server via HTTPS, regardless of what the users type in the address bar. +# http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14#section-6.1 # http://www.html5rocks.com/en/tutorials/security/transport-layer-security/ +# (!) Remove the `includeSubDomains` optional directive if the subdomains are +# not using HTTPS. + # -# Header set Strict-Transport-Security max-age=16070400; +# Header set Strict-Transport-Security "max-age=16070400; includeSubDomains" # # ------------------------------------------------------------------------------ diff --git a/apache/README.md b/apache/README.md index 9979050..288ae56 100644 --- a/apache/README.md +++ b/apache/README.md @@ -7,13 +7,15 @@ can be applied in the `.htaccess` file. **First, you'll want to have these modules enabled for optimum performance:** -* `mod_setenvif.c` (setenvif_module) -* `mod_headers.c` (headers_module) -* `mod_deflate.c` (deflate_module) -* `mod_filter.c` (filter_module) -* `mod_expires.c` (expires_module) -* `mod_rewrite.c` (rewrite_module) - +* [`mod_autoindex.c` (autoindex_module)](http://httpd.apache.org/docs/current/mod/mod_autoindex.html) +* [`mod_deflate.c` (deflate_module)](http://httpd.apache.org/docs/current/mod/mod_deflate.html) +* [`mod_expires.c` (expires_module)](http://httpd.apache.org/docs/current/mod/mod_expires.html) +* [`mod_filter.c` (filter_module)](http://httpd.apache.org/docs/current/mod/mod_filter.html) +* [`mod_headers.c` (headers_module)](http://httpd.apache.org/docs/current/mod/mod_headers.html) +* [`mod_include.c` (include_module)](http://httpd.apache.org/docs/current/mod/mod_include.html) +* [`mod_mime.c` (mime_module)](http://httpd.apache.org/docs/current/mod/mod_mime.html) +* [`mod_rewrite.c` (rewrite_module)](http://httpd.apache.org/docs/current/mod/mod_rewrite.html) +* [`mod_setenvif.c` (setenvif_module)](http://httpd.apache.org/docs/current/mod/mod_setenvif.html) ## On Windows diff --git a/gae/app.yaml b/gae/app.yaml index 3c98167..a299c20 100644 --- a/gae/app.yaml +++ b/gae/app.yaml @@ -79,7 +79,7 @@ handlers: http_headers: # Better website experience for IE users - X-UA-Compatible: "IE=edge,chrome=1" + X-UA-Compatible: "IE=edge" # Content Security Policy (CSP) #Content-Security-Policy: "script-src 'self'; object-src 'self'" diff --git a/gae/gae.py b/gae/gae.py index ba43d68..18a0652 100644 --- a/gae/gae.py +++ b/gae/gae.py @@ -9,7 +9,7 @@ def get(self): else: path = '%s/index.html'%self.request.url - self.response.headers.add_header('X-UA-Compatible', 'IE=edge,chrome=1') + self.response.headers.add_header('X-UA-Compatible', 'IE=edge') self.redirect(path) def post(self): diff --git a/iis/IIS6-README.md b/iis/IIS6-README.md index dabf158..e46358e 100644 --- a/iis/IIS6-README.md +++ b/iis/IIS6-README.md @@ -205,7 +205,7 @@ Force the latest IE version, in various cases when it may fall back to IE7 mode http://github.com/rails/rails/commit/123eb25#commitcomment-118920 ``` -X-UA-Compatible : IE=Edge,chrome=1 +X-UA-Compatible : IE=Edge ``` #### 2.3.3 P3P (handy when your using Facebook API/Connect) diff --git a/iis/README.md b/iis/README.md index 9a286ad..beb8c4a 100644 --- a/iis/README.md +++ b/iis/README.md @@ -72,7 +72,7 @@ served to show customized error message. **5. Force the latest IE version** ```xml - + ``` Force the latest IE version, in various cases when it may fall back to IE7 @@ -125,7 +125,7 @@ Required for SVG Webfonts on iPad. ```xml - + ``` diff --git a/iis/dotnet 3/web.config b/iis/dotnet 3/web.config index 97667f9..30f6faa 100644 --- a/iis/dotnet 3/web.config +++ b/iis/dotnet 3/web.config @@ -136,7 +136,7 @@ - + @@ -239,9 +239,8 @@ - + - + - +