#
# Apache/PHP/Drupal settings:
#

# Don't show directory listings for URLs which map to a directory.
Options -Indexes

# Set the default handler.
DirectoryIndex index.php index.html index.htm

# -- Rewrite rules.
RewriteEngine on

# Do not loop.
RewriteCond %{ENV:REDIRECT_STATUS} !^$
RewriteRule .* - [L]

# HTTP to HTTPS redirect.
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Redirect all users to access the site WITHOUT the 'www.' prefix,
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# Block bots.
RewriteCond %{REQUEST_URI} ^/contact [OR]
RewriteCond %{REQUEST_URI} ^/user [OR]
RewriteCond %{REQUEST_URI} ^/wp [OR]
RewriteCond %{REQUEST_URI} ^/comment [OR]
RewriteCond %{REQUEST_URI} user/password
RewriteRule .* - [L,R=404]

# Pass all requests not referring directly to files in the filesystem to
# index.php.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]

# Trusted paths.
RewriteCond %{REQUEST_URI} ^/robots.txt$ [OR]
RewriteCond %{REQUEST_URI} ^/sites/simpletest/browser_output/*
RewriteRule .* - [L]

# Block access to existing files that are not whitelisted.
RewriteCond %{REQUEST_URI} !\.(jpg|png|gif|svg|css|js|ico)$
RewriteRule .* - [L,R=404]