חסמו קבצים חשופים .git, ‏.env וגיבויים

curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.env
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.git/HEAD
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/backup.sql

# hidden files and folders (.git, .env, .htpasswd), but keep /.well-known working
location ~ /\.(?!well-known/) { deny all; }
# backups and dumps
location ~* \.(sql|bak|old|orig|swp|log)$ { deny all; }

RedirectMatch 404 "/\.(git|svn|hg)(/|$)"
<FilesMatch "(^\.env|\.(sql|bak|old|orig|swp|log)$|~$)">
  Require all denied
</FilesMatch>
Options -Indexes