diff --git a/README.md b/README.md
index 5f2e89bc9cd769636d26b0a38acd3b2a14460c09..8c1d5a749c685e56372915556a0a68ebef09a679 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,9 @@ key: ~
 
 # SSL certificat, mutally exclusive with letsencrypt option
 crt: ~
+
+# Disallow access to dotfiles besides .well-known by default
+disallow_dotfiles: True
 ```
 
 **locationconfig**:
diff --git a/defaults/main.yml b/defaults/main.yml
index a7c56a1d3cc09937866fd7075248a87080e9c965..86ffecf8bd77108edcb49fceefe7cb4bc5fbdfb6 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -45,6 +45,7 @@ nginx_vhosts_defaults:
   add_proxy_headers: {}
   hide_proxy_headers: {}
   backend: ~
+  disallow_dotfiles: True
 
 nginx_streams_defaults:
   listen:
diff --git a/templates/vhost.conf.j2 b/templates/vhost.conf.j2
index bbffbecf348df222a94d4af842d7082cc4a6c98c..255d316b106290741ed94dca576ae073bfeb15f4 100644
--- a/templates/vhost.conf.j2
+++ b/templates/vhost.conf.j2
@@ -86,6 +86,15 @@ server {
 	}
 	{% endfor %}
 
+
+	{% if vhost.disallow_dotfiles %}
+	# disallow every path starting with a dot except .well-known/
+	location ~ /\.(?!well-known\/).* {
+		deny all;
+	}
+	{% endif %}
+
+
 	{% if vhost.auth.enable %}
 	auth_basic           "restricted area";
 	auth_basic_user_file {{ vhost.auth.path }};