nginx

Add this to every server { … } block of the site, above the other location blocks: on Debian and Ubuntu in /etc/nginx/sites-available/example.com, on Rocky, Alma and CentOS in /etc/nginx/conf.d/example.com.conf:

# Every path that starts with a dot, except /.well-known/.
location ~ /\.(?!well-known/) {
    deny all;
}

nginx uses the first regular-expression location that matches, so this one has to come before rules like location ~ \.php$.

sudo nginx -t && sudo systemctl reload nginx

Apache and LiteSpeed

Add this at the top of the .htaccess in the site's root folder, or inside the site's <VirtualHost> if you manage the server:

# Every path that starts with a dot, except /.well-known/.
RedirectMatch 404 /\.(?!well-known/)

It answers 404, as if the files did not exist. It works on Apache and on LiteSpeed. <FilesMatch "^\.env"> is not enough: it matches file names only, and inside .git the files are called HEAD, config and so on.

With server access, reload after the change:

sudo apachectl configtest && sudo systemctl reload apache2

(httpd instead of apache2 on Rocky, Alma and CentOS.)

Laravel

The web server's document root must be the public/ folder, never the project folder. Then .env, .git, vendor/ and storage/ all sit outside what the server can serve, and no extra rule is needed. Laravel Forge, Ploi and Laravel Cloud set this up by default.

On shared hosting where the document root is fixed to public_html, do not upload the whole project into public_html. Upload it next to it (for example ~/example-app) and point the document root at its public folder in the panel (see the cPanel and Plesk tabs). If the panel does not allow that, replace public_html with a link to it over SSH:

mv ~/public_html ~/public_html.old
ln -s ~/example-app/public ~/public_html

Ask the host first if you are not sure links are allowed. Until the move is done, the .htaccess rule from the Apache tab is the stopgap.

cPanel

Quick block: add the RedirectMatch line from the Apache tab to .htaccess in public_html (File Manager, with Show Hidden Files on).

Move the document root for an addon domain or subdomain: Domains → Domains, Manage next to the domain, change New Document Root to the folder with the public files (for example example-app/public) and Update. The main domain's document root is fixed to public_html; for it, use the link from the Laravel tab or ask the host.

Deploying with Git Version Control: clone the repository outside public_html and copy only the public files into it with a .cpanel.yml deployment file. A repository cloned straight into public_html publishes its .git folder.

Plesk

Quick block: Websites & Domains → example.com → Apache & nginx Settings, in Additional nginx directives add:

location ~ /\.(?!well-known/) {
    deny all;
}

Move the document root: in the domain's Hosting Settings (in newer Plesk versions Hosting & DNS → Hosting), set Document root to the public folder, for example httpdocs/public for Laravel or Bedrock, and save.

If you deploy with Plesk's Git extension, set its deployment path to the document root and keep the repository itself outside it.

Cloudflare

If the site runs behind Cloudflare (orange cloud), a WAF rule blocks both paths in a minute, on the free plan too:

1. Open the domain and go to Security → WAF → Custom rules (in the newer dashboard Security → Security rules) and create a rule.
2. Name it Block .git and .env, click Edit expression and paste:

(http.request.uri.path contains "/.git" or http.request.uri.path contains "/.env")

3. Choose the action Block and Deploy.

This only protects traffic that goes through Cloudflare. Anyone who knows the server's IP address can still ask it directly, so fix the server too.

IIS and ASP.NET

IIS can hide whole path segments. In the site's web.config:

<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <hiddenSegments>
          <add segment=".git" />
          <add segment=".env" />
        </hiddenSegments>
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

Requests for these paths get 404. By default IIS also refuses files without a known MIME type, so a public .env usually means someone added a catch-all mimeMap; remove it.

Node.js and Next.js

Next.js serves only the public/ folder, so .env and .git leak only when something in front of it (nginx, Apache) points at the project folder. Fix that server's document root or add the rule from its tab.

In Express, serve a dedicated folder and never the project root:

app.use(express.static(path.join(__dirname, 'public')));

express.static(__dirname) publishes everything next to the code, .env and .git included.