Sane nginx default for 99.999% sites out there:

# prevent access to any file/dir beginning with a dot

location ~ /\. { return 404; }