Fundamentals
What is a .env file?
The dotenv format, where it comes from, what usually lives inside, and why it must stay private.
7 min read
Guides
Protect your environment files
Short, practical guides with configuration you can copy, explanations of why it works, and a checklist at the end of each one.
Fundamentals
Fundamentals
How to protect your .env file from public access
Keep secrets out of the web root, block dotfiles, and know what to do after an exposure.
9 min read
Web servers
Web servers
How to block .env files in Nginx
Location blocks that deny dotfiles, keep /.well-known reachable, and survive config refactors.
8 min read
Web servers
How to block .env files in Apache
Require all denied for dotfiles in the vhost or .htaccess, and the AllowOverride trap.
7 min read
Frameworks
Frameworks
Laravel .env security
Point the document root at public/, disable debug mode, cache config and rotate APP_KEY safely.
9 min read
Frameworks
Node.js .env security
Static file middleware, public env prefixes in bundlers, Docker images and secret managers.
9 min read