diff --git a/nginx/sites/default.conf b/nginx/sites/default.conf
index fe990a8..5ca539d 100644
--- a/nginx/sites/default.conf
+++ b/nginx/sites/default.conf
@@ -26,6 +26,10 @@ server {
         deny all;
     }
 
+    location ~ /\.git {
+        deny all;
+    }
+
     location /.well-known/acme-challenge/ {
         root /var/www/letsencrypt/;
         log_not_found off;