diff --git a/README.md b/README.md
index 5f2e89b..8c1d5a7 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,9 @@ key: ~
 
 # SSL certificat, mutally exclusive with letsencrypt option
 crt: ~
+
+# Disallow access to dotfiles besides .well-known by default
+disallow_dotfiles: True
 ```
 
 **locationconfig**:
diff --git a/defaults/main.yml b/defaults/main.yml
index a7c56a1..86ffecf 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -45,6 +45,7 @@ nginx_vhosts_defaults:
   add_proxy_headers: {}
   hide_proxy_headers: {}
   backend: ~
+  disallow_dotfiles: True
 
 nginx_streams_defaults:
   listen:
diff --git a/templates/vhost.conf.j2 b/templates/vhost.conf.j2
index bbffbec..255d316 100644
--- a/templates/vhost.conf.j2
+++ b/templates/vhost.conf.j2
@@ -86,6 +86,15 @@ server {
 	}
 	{% endfor %}
 
+
+	{% if vhost.disallow_dotfiles %}
+	# disallow every path starting with a dot except .well-known/
+	location ~ /\.(?!well-known\/).* {
+		deny all;
+	}
+	{% endif %}
+
+
 	{% if vhost.auth.enable %}
 	auth_basic           "restricted area";
 	auth_basic_user_file {{ vhost.auth.path }};