Options -Indexes RewriteEngine On RewriteCond $1 !^(css) RewriteRule ^([^/]*)/([^/]*)$ /?dir=$1&file=$2 [L] AddType text/css .css Header always set X-FRAME-OPTIONS "DENY" Header set Content-Security-Policy "script-src 'self'" ExpiresActive On ExpiresDefault "access plus 1 day"