mozillach.conf

<VirtualHost *:80>
    ServerName mozilla.ch
    ServerAlias www.mozilla.ch

    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"

    DocumentRoot /var/www/html/web
    <Directory /var/www/html/web>
        AllowOverride None
        Require all granted

        <FilesMatch "\.php">
            Header always set X-XSS-Protection "1; mode=block"
            Header always set Content-Security-Policy "default-src https://www.mozilla.org 'self'; style-src 'self' 'unsafe-inline' https://www.mozilla.org https://platform.twitter.com; script-src 'self' https://www.mozilla.org https://platform.twitter.com https://cdn.syndication.twimg.com https://syndication.twitter.com https://mozorg.cdn.mozilla.net; img-src 'self' https://www.mozilla.org https://cdn.mozillians.org https://secure.gravatar.com https://*.twimg.com https://syndication.twitter.com data:; frame-ancestors 'self'; reflected-xss 'block'; referrer 'origin-when-cross-origin'; plugin-types 'none'"
        </FilesMatch>

        <IfModule mod_rewrite.c>
            Options -MultiViews

            RewriteEngine On
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteRule ^(.*)$ app.php [QSA,L]
        </IfModule>

        <IfModule mod_deflate.c>
            AddOutputFilterByType DEFLATE text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml font/ttf font/opentype font/x-woff text/cache-manifest image/x-icon
        </IfModule>

        <FilesMatch "\.(js|css|png|jpg|jpeg|gif|ico|svg|ttf|woff|woff2)$">
            <IfModule mod_expires.c>
                ExpiresActive on
                ExpiresDefault "access plus 7 days"
            </IfModule>
            FileETag MTime Size
        </FilesMatch>
    </Directory>

    <Directory /var/www/html>
        Options FollowSymlinks
    </Directory>

    php_value date.timezone "Europe/Zurich"
    php_value short_open_tag off
    php_value default_locale "de_CH"
    php_value display_errors off

    ErrorLog /var/log/apache2/project_error.log
    CustomLog /var/log/apache2/project_access.log combined
</VirtualHost>