.htaccess

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews
    </IfModule>

    # Make sure .env files not not browseable if in a sub-directory.
    <FilesMatch "\.env$">
       # Apache 2.2
       <IfModule !authz_core_module>
          Deny from all
       </IfModule>
       
       # Apache 2.4+
       <IfModule authz_core_module>
          Require all denied
       </IfModule>
    </FilesMatch>
    
</IfModule>