ProbeHunt

Block exposed .git and .env files

Exposure · about 15 min

In plain words

A file that should never be public — your Git history or an .env file with passwords and API keys — can be downloaded by anyone.

What can go wrong

Critical. Attackers can recover your source code, database passwords and API keys, then take over the site and connected services.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

location ~ /\.(?!well-known) {
  deny all;
  return 404;
}

Apache / .htaccess

<FilesMatch "^\.">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git

Deploy hygiene

Deploy a build folder (dist/, public/) — never the repository root.
Add .env to .gitignore and keep secrets in your host’s environment settings.
Before you change anything: Blocking the file is not enough: assume every secret in it is already stolen. Rotate all passwords and API keys it contained, and check logs for misuse.

Check that it worked

Re-run the ProbeHunt check; /.git/config and /.env should return 403 or 404.

Re-run the free check

References