update: .htaccess to force https

8fold · Jan 13, 2024 · 41d6190 · 41d6190
1 parent 23f2c46
commit 41d6190
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/site-root/public/.htaccess b/site-root/public/.htaccess
@@ -19,6 +19,11 @@ ErrorDocument 500 /error-500.html
 	Header add Access-Control-Allow-Methods "GET, HEAD"
 	Header add Allow "GET, HEAD"
 
+	# Force HTTPS
+	RewriteCond %{HTTPS} !=on
+	RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
+	Header always set Content-Security-Policy "upgrade-insecure-requests;"
+
 	# Always remove www
 	RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
 	RewriteRule ^(.*)$ http://%1%{REQUEST_URI} [R=301,QSA,NC,L]