vhost

# vhost domainname.com

<VirtualHost *:80>
        DocumentRoot /var/www/html/domainname.com
  ServerName domainname.com
  ServerAlias domainname.com
  RewriteEngine on
  RewriteCond %{HTTP_HOST} ^www.domainname.com
  RewriteRule ^/(.*)$ http://domainname.com/$1 [L,R=301]
  RewriteCond %{SERVER_NAME} =domainname.com
  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined


</VirtualHost>

<VirtualHost *:443>
        ServerName domainname.com
        ServerAdmin This email address is being protected from spambots. You need JavaScript enabled to view it.
        DocumentRoot /var/www/html/domainname.com
        #ErrorLog /var/www/log/error-log
        #CustomLog /var/www/log/access-log combined
        #ErrorLog "|/usr/sbin/rotatelogs -l /var/www/log/domainname.com-errorlog.%Y-%m-%d-%H_%M_%S 5M"
        #CustomLog "|/usr/sbin/rotatelogs -l /var/www/log/domainname.com-accesslog.%Y.%m.%d.log 86400" common

        SSLEngine on
        SSLHonorCipherOrder on
        SSLProtocol -all +TLSv1.1 +TLSv1.2 +TLSv1.3
        SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES256-GCM-SHA384

        Header always set Strict-Transport-Security "max-age=15552000; includeSubdomains;"

        Include /etc/letsencrypt/options-ssl-apache.conf

        <Directory /var/www/html/domainname.com>
                Options -Indexes -MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
                AllowOverride All
   #block bad agent
   Include /etc/apache2/custom.d/globalblacklist.conf
  ErrorDocument 400 /400.html
  ErrorDocument 401 /401.html
  ErrorDocument 403 /403.html
  ErrorDocument 404 /404.html
  ErrorDocument 408 /408.html
  ErrorDocument 431 /431.html
  ErrorDocument 451 /451.html
  ErrorDocument 500 /500.html
  ErrorDocument 501 /501.html
  ErrorDocument 502 /502.html
  ErrorDocument 503 /503.html

                Require all granted
        </Directory>

 <FilesMatch \.php$>
         # Apache 2.4.10+ can proxy to unix socket
         SetHandler "proxy:unix:/var/run/php/php8.2-fpm.sock|fcgi://localhost"
     </FilesMatch>


        <IfModule mod_headers.c>
                Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
                Header set x-Frame-Options "SAMEORIGIN"
                Header set X-XSS-Protection "1; mode=block"
                Header set X-Content-Type-Options "nosniff"
                Header set Content-Security-Policy "default-src 'self' data:  *.domainname.com *.gravatar.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' data: *.domainname.com *.gravatar.com; style-src 'self' 'unsafe-inline' data: *.domainname.com *.gravatar.com;"
        </IfModule>

    SSLCertificateFile /etc/letsencrypt/live/domainname.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domainname.com/privkey.pem
</VirtualHost>