- 'always set X-Frame-Options "SAMEORIGIN"'
- 'always set X-Content-Type-Options "nosniff"'
- 'always set Strict-Transport-Security: "max-age=15768001"'
- - 'always set Referrer-Policy "strict origin"'
+ - 'always set Referrer-Policy "strict-origin"'
- "always set Content-Security-Policy \"default-src 'none'; connect-src 'self' www.google-analytics.com; script-src 'self' data: www.google-analytics.com 'sha256-aed8ae7e95bc21fd56a9074f9eedd4db237cf41ebb8ea603d8bf6764f0d23f4c'; style-src 'self' data: https://webfonts.sparkasse.de 'unsafe-inline'; img-src 'self' data: img.vxcdn.com www.google-analytics.com www.verivox.de; font-src 'self' data: https://webfonts.sparkasse.de; child-src 'self'; object-src 'self'; form-action 'self'; report-uri /api/v1/report;\""
aliases:
directoryindex: 'index.html'
custom_fragment: |
AddType text/plain .tmpl
+
## Configuration of the cache expiration
# Images and Fonts are versioned and should be cached 1 year
# JS and CSS are versioned, but should only be cached for 1 month