Security: Hide all hidden directories behind a 404.

Never use access denied for these.
Whether they exist or not, a 404 should be returned.

diff --git a/.htaccess b/.htaccess
index 5b69a3bee6fcd6a69785920a9288bcac2e75b56e..501a0295ef0a83afb637c7df1ece4929407b3040 100644 (file)
--- a/.htaccess
+++ b/.htaccess
@@ -3,6 +3,9 @@ RewriteEngine on
 ErrorDocument 403 /access_denied.html
 ErrorDocument 404 /not_found.html
 
+RewriteBase "/"
+RewriteRule (^\.|/\.) /not_found.html [L]
+
 RewriteCond %{REQUEST_FILENAME} -f
 RewriteRule . - [L]