.ENV file is visible

Please create a .htaccess file where you have .env file and write the code as shown below:

# STRONG HTACCESS PROTECTION
<Files ~ "^.*\.([Ee][Nn][Vv])">
 order allow,deny
 deny from all
 satisfy all
</Files>

Then try to hit the .env file from url and it will not be available and show codes inside.

If you want to remove it from github.

Please create new file .gitignore on the same directory.

and add line

.env

Finally I hide .env and disable index view of the folder named local. I create a .htaccess in folder local.

And here is the code of .htaccess

# Disable index view
Options -Indexes

# Hide a specific file
<Files .env>
    Order allow,deny
    Deny from all
</Files>

Related