.htaccess

<IfModule mod_headers.c>
  # Apply some more security.
  Header set Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
  Header set Content-Security-Policy: "default-src 'none'; script-src analytics.wimme.net 'self' 'unsafe-inline' 'unsafe-eval'; connect-src analytics.wimme.net 'self'; img-src img.wimme.net data: 'self'; style-src fonts.googleapis.com 'self' 'unsafe-inline'; object-src 'self'; media-src 'self'; font-src fonts.gstatic.com data: 'self'; frame-src 'self'"

  # Request client hints for image proxy.
  Header set Accept-CH: "Sec-CH-Viewport-Width, Sec-CH-Width, Sec-CH-DPR"
  Header set Permissions-Policy: "ch-viewport-width=(self \"https://img.wimme.net\"), ch-width=(self \"https://img.wimme.net\"), ch-dpr=(self \"https://img.wimme.net\")"
</IfModule>

# Don't show directory listings for URLs which map to a directory.
Options -Indexes

# Set the default handler.
DirectoryIndex index.php index.html

# Requires mod_expires to be enabled.
<IfModule mod_expires.c>
  # Enable expirations.
  ExpiresActive On
  # Cache all files for 2 weeks after access (A).
  ExpiresDefault A1209600
  <FilesMatch \.php$>
    # Do not allow PHP scripts to be cached unless they explicitly send cache headers themselves.
    ExpiresActive Off
  </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Restricting access to directories
  RewriteRule "(^|/)\." - [F]

  # Redirection to HTTPS:
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

  # Redirection www to non-www:
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

  # Custom 404
  ErrorDocument 404 /404.html

  # Proxy to backend:
  RewriteRule ^system/(.*)$ https://cms.wimme.net/system/$1 [P]

  # Redirect old urls:
  RewriteRule ^feed/$ /feed.xml [R=301,L]
  RewriteRule ^sitemap/$ /sitemap.xml [R=301,L]

  # Redirect requests from index.html to their parent folder
  RewriteRule ^index\.html$ / [R=301,L]
  RewriteRule ^(.*)/index\.html$ /$1/ [R=301,L] # with trailing slash
</IfModule>