apache_tweak.conf

ServerSignature On
ServerTokens Prod
TraceEnable Off

<IfModule ssl_module>
  SSLProtocol all -SSLv3 -SSLv2
  SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
  SSLHonorCipherOrder on
  SSLSessionTickets Off
  SSLCompression Off
  SSLUseStapling on
  SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
</IfModule>

<IfModule http2_module>
  ProtocolsHonorOrder On
  Protocols h2 h2c http/1.1
</IfModule>

<IfModule autoindex_module>
  Options +Indexes -ExecCGI +FollowSymLinks
  DirectoryIndex index.php index.html
  AddDefaultCharset UTF-8
  <FilesMatch "\.(sh|bat|cmd|zip|rar|gz)$">
     Require all denied
  </FilesMatch>
  <DirectoryMatch "\.(svn|git)$">
    Require all denied
  </DirectoryMatch>
</IfModule>

<IfModule cache_module>
  <IfModule cache_disk_module>
    CacheRoot /tmp/
    CacheEnable disk  /
    CacheDirLevels 2
    CacheDirLength 8
  </IfModule>
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access 1 year"
  ExpiresByType image/jpeg "access 1 year"
  ExpiresByType image/gif "access 1 year"
  ExpiresByType image/png "access 1 year"
  ExpiresByType text/css "access 1 month"
  ExpiresByType text/html "access 1 month"
  ExpiresByType application/pdf "access 1 month"
  ExpiresByType text/x-javascript "access 1 month"
  ExpiresByType application/x-shockwave-flash "access 1 month"
  ExpiresByType image/x-icon "access 1 year"
  ExpiresDefault "access 1 month"
</IfModule>

<FilesMatch "\\.(js|css|html|htm|php|xml)$">
  SetOutputFilter DEFLATE
</FilesMatch>

<IfModule mod_gzip.c>
  mod_gzip_on Yes
  mod_gzip_dechunk Yes
  mod_gzip_item_include file \.(html?|txt|css|js|php|pl)$
  mod_gzip_item_include handler ^cgi-script$
  mod_gzip_item_include mime ^text/.*
  mod_gzip_item_include mime ^application/x-javascript.*
  mod_gzip_item_exclude mime ^image/.*
  mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</IfModule>