.htaccess

# Enable the rewrite engine
RewriteEngine On

# Force HTTPS
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.teendevops.net/$1 [R,L]

# Block access to /phpmyadmin, if exists
RewriteRule ^(/phpmyadmin) - [F,L,NC]

# Rewrite url parameters
RewriteRule ^profile/([^/]+)/?$ /profile.php?username=$1 [L]
RewriteRule ^profiles/([^/]+)/?$ /profile.php?username=$1 [L]
RewriteRule ^users/([^/]+)/?$ /profile.php?username=$1 [L]
RewriteRule ^user/([^/]+)/?$ /profile.php?username=$1 [L]
RewriteRule ^chat/([^/]+)/?$ /chat.php?channel=$1 [L]
RewriteRule ^channel/([^/]+)/?$ /chat.php?channel=$1 [L]

# Append .php if that file exists (internal rewrite)
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule (.*?)/?$ $1.php [L]

# Enable security headers
Header set X-Frame-Options DENY
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy no-referrer
Header set X-Easter-Egg "You found an easter egg: e4st3r_egg_5"
Header set Strict-Transport-Security "max-age=31536000; includeSubdomains" env=HTTPS
Header set Content-Security-Policy "script-src 'self' https://teendevops.net https://*.teendevops.net https:;"

# Disabled security headers below...
#     Header always set Public-Key-Pins "pin-sha256=\"VetzveJCgWcgnxPMy9CdWWK7IOwBa/CgNXms6Gmhq6g=\"; max-age=5184000"