diff --git a/php/cache/.htaccess b/php/cache/.htaccess
new file mode 100644
index 0000000..6fed7bd
--- /dev/null
+++ b/php/cache/.htaccess
@@ -0,0 +1,3 @@
+# Empeche l'acces HTTP direct aux fichiers de cache (contenu non
+# sensible, mais autant ne pas l'exposer inutilement).
+Require all denied
diff --git a/php/common.php b/php/common.php
index b08f543..273eaf4 100644
--- a/php/common.php
+++ b/php/common.php
@@ -30,6 +30,7 @@ function http_get(string $url, array $extraHeaders = []): string
         CURLOPT_HTTPHEADER => array_merge(['Accept: application/json'], $extraHeaders),
         CURLOPT_TIMEOUT => 20,
         CURLOPT_FOLLOWLOCATION => true,
+        CURLOPT_MAXREDIRS => 3,
     ]);
     $body = curl_exec($ch);
     $errno = curl_errno($ch);