Created
November 28, 2025 18:24
-
-
Save esedic/4d1f230e94e3309f36cec3eb1a6bc812 to your computer and use it in GitHub Desktop.
Browser caching in .htaccess in 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## BEGIN EXPIRES CACHING ## | |
| <IfModule mod_expires.c> | |
| ExpiresActive on | |
| # Perhaps better to whitelist expires rules? Perhaps. | |
| ExpiresDefault "access plus 1 year" | |
| # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) | |
| ExpiresByType text/cache-manifest "access plus 0 seconds" | |
| # Your document html | |
| ExpiresByType text/html "access plus 0 seconds" | |
| # Data | |
| ExpiresByType text/xml "access plus 0 seconds" | |
| ExpiresByType application/xml "access plus 0 seconds" | |
| ExpiresByType application/json "access plus 0 seconds" | |
| # Feed | |
| ExpiresByType application/rss+xml "access plus 1 hour" | |
| ExpiresByType application/atom+xml "access plus 1 hour" | |
| # Favicon (cannot be renamed) | |
| ExpiresByType image/x-icon "access plus 1 week" | |
| ExpiresByType image/vnd.microsoft.icon "access plus 1 week" | |
| # Media: images, video, audio | |
| ExpiresByType image/gif "access plus 1 year" | |
| ExpiresByType image/png "access plus 1 year" | |
| ExpiresByType image/jpg "access plus 1 year" | |
| ExpiresByType image/jpeg "access plus 1 year" | |
| ExpiresByType image/webp "access plus 1 year" | |
| ExpiresByType image/avif "access plus 1 year" | |
| ExpiresByType image/svg+xml "access plus 1 year" | |
| ExpiresByType audio/ogg "access plus 1 year" | |
| ExpiresByType audio/mpeg "access plus 1 year" | |
| ExpiresByType video/ogg "access plus 1 year" | |
| ExpiresByType video/mp4 "access plus 1 year" | |
| ExpiresByType video/webm "access plus 1 year" | |
| # HTC files (css3pie) | |
| ExpiresByType text/x-component "access plus 1 year" | |
| # Webfonts | |
| ExpiresByType font/ttf "access plus 1 year" | |
| ExpiresByType font/otf "access plus 1 year" | |
| ExpiresByType font/woff "access plus 1 year" | |
| ExpiresByType font/woff2 "access plus 1 year" | |
| ExpiresByType application/font-ttf "access plus 1 year" | |
| ExpiresByType application/font-otf "access plus 1 year" | |
| ExpiresByType application/font-woff "access plus 1 year" | |
| ExpiresByType application/font-woff2 "access plus 1 year" | |
| ExpiresByType application/x-font-ttf "access plus 1 year" | |
| ExpiresByType application/x-font-woff "access plus 1 year" | |
| ExpiresByType application/vnd.ms-fontobject "access plus 1 year" | |
| # CSS and JavaScript | |
| ExpiresByType text/css "access plus 1 year" | |
| ExpiresByType text/javascript "access plus 1 year" | |
| ExpiresByType application/javascript "access plus 1 year" | |
| ExpiresByType application/x-javascript "access plus 1 year" | |
| <IfModule mod_headers.c> | |
| Header append Cache-Control "public" | |
| <FilesMatch "\.(js|css|xml|gz|html)$"> | |
| Header append Vary: Accept-Encoding | |
| </FilesMatch> | |
| </IfModule> | |
| </IfModule> | |
| ## END EXPIRES CACHING ## | |
| ## BEGIN COMPRESSION ## | |
| # Gzip compression | |
| <IfModule mod_deflate.c> | |
| AddOutputFilterByType DEFLATE text/html | |
| AddOutputFilterByType DEFLATE text/css | |
| AddOutputFilterByType DEFLATE text/javascript | |
| AddOutputFilterByType DEFLATE text/xml | |
| AddOutputFilterByType DEFLATE text/plain | |
| AddOutputFilterByType DEFLATE image/x-icon | |
| AddOutputFilterByType DEFLATE image/svg+xml | |
| AddOutputFilterByType DEFLATE application/rss+xml | |
| AddOutputFilterByType DEFLATE application/javascript | |
| AddOutputFilterByType DEFLATE application/x-javascript | |
| AddOutputFilterByType DEFLATE application/xml | |
| AddOutputFilterByType DEFLATE application/xhtml+xml | |
| AddOutputFilterByType DEFLATE application/json | |
| AddOutputFilterByType DEFLATE application/font | |
| AddOutputFilterByType DEFLATE application/font-truetype | |
| AddOutputFilterByType DEFLATE application/font-ttf | |
| AddOutputFilterByType DEFLATE application/font-otf | |
| AddOutputFilterByType DEFLATE application/font-opentype | |
| AddOutputFilterByType DEFLATE application/font-woff | |
| AddOutputFilterByType DEFLATE application/font-woff2 | |
| AddOutputFilterByType DEFLATE application/vnd.ms-fontobject | |
| AddOutputFilterByType DEFLATE font/ttf | |
| AddOutputFilterByType DEFLATE font/otf | |
| AddOutputFilterByType DEFLATE font/opentype | |
| AddOutputFilterByType DEFLATE font/woff | |
| AddOutputFilterByType DEFLATE font/woff2 | |
| </IfModule> | |
| # Brotli compression (if available, typically Apache 2.4.26+) | |
| <IfModule mod_brotli.c> | |
| AddOutputFilterByType BROTLI_COMPRESS text/html | |
| AddOutputFilterByType BROTLI_COMPRESS text/css | |
| AddOutputFilterByType BROTLI_COMPRESS text/javascript | |
| AddOutputFilterByType BROTLI_COMPRESS text/xml | |
| AddOutputFilterByType BROTLI_COMPRESS text/plain | |
| AddOutputFilterByType BROTLI_COMPRESS image/svg+xml | |
| AddOutputFilterByType BROTLI_COMPRESS application/javascript | |
| AddOutputFilterByType BROTLI_COMPRESS application/x-javascript | |
| AddOutputFilterByType BROTLI_COMPRESS application/xml | |
| AddOutputFilterByType BROTLI_COMPRESS application/xhtml+xml | |
| AddOutputFilterByType BROTLI_COMPRESS application/json | |
| AddOutputFilterByType BROTLI_COMPRESS application/rss+xml | |
| AddOutputFilterByType BROTLI_COMPRESS application/font-woff | |
| AddOutputFilterByType BROTLI_COMPRESS application/font-woff2 | |
| AddOutputFilterByType BROTLI_COMPRESS font/woff | |
| AddOutputFilterByType BROTLI_COMPRESS font/woff2 | |
| </IfModule> | |
| ## END COMPRESSION ## | |
| ## BEGIN SECURITY HEADERS ## | |
| <IfModule mod_headers.c> | |
| # Prevent MIME type sniffing | |
| Header always set X-Content-Type-Options "nosniff" | |
| # Prevent clickjacking | |
| Header always set X-Frame-Options "SAMEORIGIN" | |
| # Referrer policy | |
| Header always set Referrer-Policy "strict-origin-when-cross-origin" | |
| # Remove server signature | |
| Header always unset X-Powered-By | |
| Header unset X-Powered-By | |
| </IfModule> | |
| ## END SECURITY HEADERS ## |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment