diff --git a/.htaccess b/.htaccess
index 7e9b49e..93dd1ff 100644
--- a/.htaccess
+++ b/.htaccess
@@ -12,3 +12,9 @@ Options -Indexes
 
 #   Serve JSON documents with the correct MIME types
 AddType application/activity+json .json
+
+# Deny access to env file because it contains secrets
+# See https://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#reqall
+<Files .env>
+    Require all denied
+</Files>