diff --git a/.gitignore b/.gitignore
index 32a24cc5b..67f936715 100755
--- a/.gitignore
+++ b/.gitignore
@@ -22,6 +22,7 @@ Thumbs.db
 __pycache__
 
 ## Ignore site specific files and folders
+.env*
 .htaccess
 .htconfig.php
 .htstartup.php
diff --git a/htaccess.dist b/htaccess.dist
index 52207b075..4558590d0 100644
--- a/htaccess.dist
+++ b/htaccess.dist
@@ -3,7 +3,7 @@ AddType audio/ogg .oga
 CGIPassAuth On
 
 # don't allow any web access to logfiles, even after rotation/compression
-<FilesMatch "\.(out|log|gz)$">
+<FilesMatch "\.(out|log|gz|env)$">
   <IfModule mod_authz_core.c>
     Require all denied
   </IfModule>