How to Block .git Directory in Apache/Nginx

Version control systems, such as Git, are essential for software development. However, if not properly secured, they can expose sensitive information. Many web developers mistakenly leave the .git directory accessible in a production environment, potentially allowing anyone to download and view the repository. This article demonstrates how to block access to the .git directory in both Apache and Nginx web servers.

Apache: Using .htaccess

1. Access the .htaccess file: Navigate to the root directory of your website or the directory where the .git folder is located.
2. Edit the .htaccess file: Open .htaccess in your favorite text editor. If the file doesn’t exist, create one.
3. Block access to the .git directory: Add the following lines to your .htaccess file:

   
   # Block access to .git directory
   <Directory ~ "\.git">
       Order allow,deny
       Deny from all
   </Directory>
   
   

4. Save and close the file: After editing, save and close the .htaccess file.
5. Restart the Apache server: The configuration change will be active immediately after the file is saved. However, it’s always good to ensure the web server picks up any changes by restarting it.

Nginx

1. Access the Nginx configuration: The location of the Nginx configuration file varies based on the system, but commonly it is found in /etc/nginx/ or /usr/local/nginx/conf/. The main configuration file is usually named nginx.conf.
2. Edit the configuration: Open nginx.conf or the appropriate server block file in your favorite text editor.
3. Block access to the .git directory: Add the following block within the server block to deny access to the .git directory:

   
   # Block access to .git directory
   RedirectMatch 403 /\.git
   
   

   This configuration denies access to any path containing .git and returns a 403 Forbidden HTTP status.

4. Save and close the file: After making your changes, save and close the file.
5. Reload the Nginx configuration: To apply the changes, reload the Nginx configuration with:

   sudo nginx -s reload 
   

Testing

After you’ve applied the changes, it’s crucial to ensure they work as expected:

• Try accessing the .git directory: In your web browser, navigate to http://yourdomain.com/.git/ or any file inside that directory.
• Expect a 403 response: If everything is set up correctly, the server should return a “403 Forbidden” response.

Conclusion

Security is paramount when maintaining web servers, especially with version control systems like Git that can inadvertently expose sensitive information. Always ensure that directories like .git are blocked from public access. Regularly review and audit your web server configurations for any potential vulnerabilities.