diff --git a/source/.htaccess b/source/.htaccess
new file mode 100644
index 0000000..9019d41
--- /dev/null
+++ b/source/.htaccess
@@ -0,0 +1,20 @@
+---
+noindex: true
+---
+# Compress files on the fly
+AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript text/javascript
+
+# Aggressively cache assets
+ExpiresActive On
+ExpiresDefault "access plus 1 year"
+
+# Cache only very shortly on non cache-busted files
+ExpiresByType text/html "access plus 1 hour"
+ExpiresByType text/xml "access"
+
+RewriteEngine On
+
+# Require SSL
+RewriteCond %{HTTPS} !=on
+RewriteCond %{ENV:HTTPS} !=on
+RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
diff --git a/source/.htpasswd b/source/.htpasswd
deleted file mode 100644
index 5994ef0..0000000
--- a/source/.htpasswd
+++ /dev/null
@@ -1,13 +0,0 @@
----
-noindex: true
----
-# Compress files on the fly
-AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript text/javascript
-
-# Aggressively cache assets, rely on ETAGs for non-cache busted stuff
-<LocationMatch ^/(images|javascripts|fonts|stylesheets)/>
-  ExpiresActive On
-  ExpiresDefault "access plus 1 year"
-</LocationMatch>
-
-Alias /favicon.ico /images/favicon.ico