# ============================================================
# We are Rainbow — security headers
# RENAME THIS FILE TO:  .htaccess   (with the leading dot)
# and upload it into the same folder as the landing page.
# ============================================================

# no directory listing
Options -Indexes

<IfModule mod_headers.c>
  # clickjacking protection
  Header always set X-Frame-Options "SAMEORIGIN"
  # never let browsers guess content types
  Header always set X-Content-Type-Options "nosniff"
  # limit referrer leakage
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  # disable powerful browser features the site does not use
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"

  # Content-Security-Policy :
  # only this site + the wrb.partaj.co assets + Google Fonts can load resources
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://wrb.partaj.co https://fonts.gstatic.com; img-src 'self' data: https://wrb.partaj.co; media-src 'self' blob: https://wrb.partaj.co; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"

  # HSTS — uncomment ONLY once the whole site is served over https
  # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>