.htaccess

RewriteEngine On

Header edit Set-Cookie ^(PHPSESSID.*)$ "$1; HttpOnly"
Header always append X-Frame-Options SAMEORIGIN
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"


RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?page=$1 [L]

Options All -Indexes
ServerSignature Off
Options +SymLinksIfOwnerMatch
AddDefaultCharset UTF-8

<IfModule mod_headers.c>
    Header always append X-Frame-Options SAMEORIGIN
    Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>


RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule .* - [F]