Prevent access to .env file in Apache server?

Question

I'm new in laravel and I know the .env file is used to store database and email credentials. But when I'm opening http://servername/.env the .env file content is shown in browser.

Any chance to protect my database credentials without changing the file name to non-guessable one?

In case I'm using .htaccess to prevent file read, would this have negative effect to the laravel framework?

Answer 1

Please add below code in your .htaccess file. It works also in localhost and Live server.

# Disable Directory listing
Options -Indexes

# block files which needs to be hidden, specify .example extension of the file
<Files ~ "\.(env|json|config.js|md|gitignore|gitattributes|lock)$">
    Order allow,deny
    Deny from all
</Files>