Selected security lines for .htaccess

# SiteGround adds this:
# https://www.siteground.co.uk/blog/vary-http-header/
# SGO Unset Vary
Header unset Vary
# SGO Unset Vary END

# Tell browsers to always use https.
# This can be done through Site Tools > Security > HTTP Enforce.
# Not all browsers honour this, but some do, and Google likes it.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

# Bonus bunch of security items. Some might be unsuitable for your specific website.
Header always set Content-Security-Policy "upgrade-insecure-requests"
Header set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header always append X-Frame-Options SAMEORIGIN
Header set Referrer-Policy "no-referrer-when-downgrade"
Header always set Permissions-Policy "fullscreen=(self)"
# End of bonus bunch of security items.

# The following section forces https always everywhere, even on "hidden" items, e.g. CSS.
# SiteGround adds this if you select the right option, but you can add it manually.
# HTTPS forced by SG-Optimizer
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /

	RewriteCond %{HTTP:X-Forwarded-Proto} !https
	RewriteCond %{HTTPS} off
	RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
# END HTTPS