Hidden files and directories (those whose names start with a dot .) should most, if not all, of the time be secured. For example: .htaccess, .htpasswd, .git, .hg...
RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)\." - [F]
Alternatively, you can just raise a Not Found error, giving the attacker dude no clue:
RedirectMatch 404 /\..*$
Remember that for most rules you must have the RewriteEngine on rule in your .htaccess file!!!
Please remember to double check and verify any rules that you use. If you do not understand a rule please consult someone who does. Or if you are new, please take time to learn the basics of .htaccess. We accept no responsibility for your use of these rules - use them at your own risk. Please get in touch if you want us to add a rule!