# deny hidden files
location ~ /\. {
    access_log off;
    log_not_found off;
    deny all;
}