.htaccess

ServerSignature Off

Options -Indexes

<ifModule mod_gzip.c>
    mod_gzip_on Yes
    mod_gzip_dechunk Yes
    mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
    mod_gzip_item_include handler ^cgi-script$
    mod_gzip_item_include mime ^text/.*
    mod_gzip_item_include mime ^application/x-javascript.*
    mod_gzip_item_exclude mime ^image/.*
    mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>

<ifModule mod_headers.c>
    Header set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' www.google-analytics.com; object-src 'none'; style-src 'self' data:; img-src 'self' data:; media-src 'none'; frame-src 'none'; font-src 'none'; connect-src 'self'; report-uri /csp-report"

    Header set X-Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' www.google-analytics.com; object-src 'none'; style-src 'self' data:; img-src 'self' data:; media-src 'none'; frame-src 'none'; font-src 'none'; connect-src 'self'; report-uri /csp-report"

    Header set X-WebKit-CSP-Report-Only "default-src 'self'; script-src 'self' www.google-analytics.com; object-src 'none'; style-src 'self' data:; img-src 'self' data:; media-src 'none'; frame-src 'none'; font-src 'none'; connect-src 'self'; report-uri /csp-report"
</ifModule>