Add security headers, block .svn/.git directories

Author: divergentdave

security.conf

@@ -52,16 +52,19 @@ TraceEnable Off
 # If you use version control systems in your document root, you should
 # probably deny access to their directories. For example, for subversion:
 #
-#<DirectoryMatch "/\.svn">
-#   Require all denied
-#</DirectoryMatch>
+<DirectoryMatch "/\.svn">
+   Require all denied
+</DirectoryMatch>
+<DirectoryMatch "/\.git">
+   Require all denied
+</DirectoryMatch>
 
 #
 # Setting this header will prevent MSIE from interpreting files as something
 # else than declared by the content type in the HTTP headers.
 # Requires mod_headers to be enabled.
 #
-#Header set X-Content-Type-Options: "nosniff"
+Header set X-Content-Type-Options: "nosniff"
 
 #
 # Setting this header will prevent other sites from embedding pages from this
@@ -70,5 +73,10 @@ TraceEnable Off
 #
 #Header set X-Frame-Options: "sameorigin"
 
+# Adding X-XSS-Protection per recommendation of MDN
+Header set X-XSS-Protection: "1; mode=block"
+
+# Adding CSP, still need unsafe-inline for now gitweb timezone handling
+Header set Content-Security-Policy: "default-src 'self' 'unsafe-inline'"
 
 # vim: syntax=apache ts=4 sw=4 sts=4 sr noet