location ~ /\.ht { deny all; return 404; }