Skip to content

How to protect .env, .git and other sensitive files

Security1 min readFixes check exposed-env-or-git

Configuration and repository files left readable expose passwords and source code. Block them at the web server.

Step by step, with screenshots: Backups that actually restore: a small-site backup plan you can test →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No sensitive files are readablefail · −15 ptseffort S

Sensitive files are readable by anyone

Why it matters. /.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed. Both are the first things an automated scanner asks for.

How to fix it.
  1. Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).
  2. Move .env outside the web root and rotate every credential in it; assume the file has already been copied.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.