Home / Fix guides / Exposed .git directory
Exposed .git folder on your website: how to fix it
High
Your site serves files from the .git directory. With common tools, attackers can reconstruct your repository, including every secret that was ever committed and later removed.
Why it matters
Usually caused by deploying a project folder to a plain web server (or a static host) with the .git directory included.
Quick fix
- Remove .git from the deployed directory, or block /.git in your server config.
- Rotate any secret that has ever been committed to the repo.
- Deploy from a build output folder or via Git integration instead of uploading the project folder.
Step by step
1. Block it
Nginx: location ~ /\.git { deny all; }. Apache: RedirectMatch 404 /\.git. Static hosts: deploy only the build output (dist/, build/, .next/).
2. Rotate
Run a secret scanner over your git history (e.g. gitleaks) and rotate anything it finds.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
My .git directory is publicly accessible on my deployed site. Change the deployment so only the build output is published, add a server rule that returns 404 for /.git, and help me scan the git history for secrets to rotate.