Deny Access to Hidden Files and Folders

Why

Hidden files and folders start with a dot. Many of them hold private data or settings, for example .htaccess, .htpasswd, .env and .git. They should not be reachable from a browser.

Block them with mod_rewrite

Add this to your .htaccess file:

RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)\." - [F]

Visitors who ask for any file or folder that starts with a dot get a 403 Forbidden page.

Or show a "Not Found" page

This gives an attacker no clue that the file exists:

RedirectMatch 404 /\..*$

Keep the well-known folder

Some services need the folder /.well-known/ (for Let's Encrypt and other tools). Allow it before the block:

RewriteRule "^\.well-known/" - [L]

Put this line above the rule that blocks hidden files.

Test

Open https://example.com/.htaccess in your browser. You should see a 403 or 404 page.

Quick recap

• Add the rewrite rule to .htaccess.
• Use RedirectMatch 404 to hide that the file exists.
• Allow .well-known if you use it.