.htaccess

RewriteEngine On
RewriteBase /

RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/$1.html -f
RewriteRule ^(.+?)/?$ $1.html [NC,L]

ErrorDocument 404 /404.html

# Security headers
<IfModule mod_headers.c>
	Header set X-XSS-Protection "1; mode=block"
	Header always append Content-Security-Policy "frame-ancestors 'self' https://youtu.be https://w.soundcloud.com;"
	Header set X-Content-Type-Options "nosniff"
	Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
	Header set Referrer-Policy "same-origin"
	Header set Permissions-Policy geolocation=(self)
</IfModule>

# Browser caching
<IfModule mod_expires.c>
    ExpiresActive on

  # Favicon and cursor images
    ExpiresByType image/x-icon              "access plus 4 month"

  # Media
    ExpiresByType image/png                 "access plus 4 month"
    ExpiresByType image/webp                "access plus 4 month"
    ExpiresByType image/avif                "access plus 4 month"
    ExpiresByType image/svg                 "access plus 4 month"

  # CSS
    ExpiresByType text/css                  "access plus 4 month"

  # JavaScript
    ExpiresByType text/javascript           "access plus 4 month"
    ExpiresByType application/javascript    "access plus 4 month"

  # Web fonts
    ExpiresByType application/font-woff2    "access plus 4 month"
    ExpiresByType font/woff2                "access plus 4 month"
    ExpiresByType image/svg+xml             "access plus 4 month"
</IfModule>