diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..891814e
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,9 @@
+# Block direct web access to the .git directory and other dotfiles.
+# The .git folder lives inside public_html (docRoot) and was found to be
+# directly downloadable over HTTPS (e.g. https://orbis.orbishosting.com/.git/config),
+# which leaked a live GitHub personal access token embedded in the remote URL.
+RedirectMatch 404 /\.git
+
+<FilesMatch "^\.">
+  Require all denied
+</FilesMatch>
diff --git a/config/vhost/vhost.conf b/config/vhost/vhost.conf
index bb65144..75bd31d 100755
--- a/config/vhost/vhost.conf
+++ b/config/vhost/vhost.conf
@@ -62,6 +62,11 @@ rewrite  {
   autoLoadHtaccess        1
 }
 
+context /.git {
+  location                /dev/null
+  allowBrowse             0
+}
+
 context /.well-known/acme-challenge {
   location                /usr/local/lsws/Example/html/.well-known/acme-challenge
   allowBrowse             1