.htaccess - Make .git directory web inaccessible

Question

I have a website that I use github (closed source) to track changes and update site. The only problem is, it appears the .git directory is accessible via the web. How can I stop this and still be able to use git?

Should I use .htaccess? Should I change permissions of .git?

Answer 1

Put this in an .htaccess file at the root of your web server:

RedirectMatch 404 /.git

This solution is robust and secure: it

• works for all .git directories in your site, even if there are more than one,
• also hides other Git files like .gitignore and .gitmodules
• works even for newly-added .git directories, and
• doesn't even give away the fact that the directories exist.