# Shared hardening rules, included by every site server block.

# Deny dotfiles (e.g. .git, .env, .htaccess) except ACME well-known.
location ~ /\.(?!well-known).* {
    deny all;
    access_log off;
    log_not_found off;
}

# Block common sensitive files.
location ~* \.(engine|inc|ini|log|sh|sql|conf|bak)$ {
    deny all;
}