## Cabecera X-Frame-Options para mejorar la seguridad
Header always append X-Frame-Options SAMEORIGIN
# Tell the browser to attempt the HTTPS version first
Header add Strict-Transport-Security «max-age=157680000»
## Cabecera X-XSS-Protection para evitar ataques XSS en IE y Chrome
# Header set X-XSS-Protection «1; mode=block»
Header set X-XSS-Protection «1; mode=block»
## Cabecera X-Content-Type-Options para evitar que se carguen hojas de estilo o scripts maliciosos
Header set X-Content-Type-Options «nosniff»
# Disable server signature
Header set ServerSignature «Off»
Header set ServerTokens «Prod»
# Control Cross-Domain Policies
Header set X-Permitted-Cross-Domain-Policies «master-only»
# Cabecera Content-Security-Policy
Header set X-Content-Security-Policy «allow ‘self’;»
## Anular parámetros de consulta innecesarios de peticiones entrantes.
RewriteEngine On
RewriteCond %{QUERY_STRING} !=»»
RewriteCond %{QUERY_STRING} !^p=.*
RewriteCond %{QUERY_STRING} !^s=.*
RewriteCond %{REQUEST_URI} !^/wp-admin.*
RewriteRule ^(.*)$ /$1? [R=301,L]
# Compresion deflate (gzip) segun tipo
AddOutputFilterByType DEFLATE text/plain text/html
AddOutputFilterByType DEFLATE text/xml application/xml application/xhtml+xml application/xml-dtd
AddOutputFilterByType DEFLATE application/rdf+xml application/rss+xml application/atom+xml image/svg+xml
AddOutputFilterByType DEFLATE text/css text/javascript application/javascript application/x-javascript
AddOutputFilterByType DEFLATE font/otf font/opentype application/font-otf application/x-font-otf
AddOutputFilterByType DEFLATE font/ttf font/truetype application/font-ttf application/x-font-ttf
order allow,deny
deny from all