On Linux, any file or directory whose name starts with a dot (.) is hidden: ls doesn’t show it by default. There’s no special attribute, just the naming convention. Hidden files (“dotfiles”) are mostly configuration: shell settings, SSH keys, Git data, and application secrets.

Show hidden files

ls -a          # all entries, including . and ..
ls -A          # all, except . and ..
ls -la         # long listing with hidden files
ls -ld .*      # only hidden entries in the current directory

In file managers, press Ctrl+H. In SFTP clients (FileZilla, WinSCP), enable “show hidden files”.

Create and hide files

touch .notes            # create a hidden file
mkdir .backup           # hidden directory
mv notes.txt .notes.txt # hide an existing file by renaming it
mv .notes.txt notes.txt # unhide

Important dotfiles on a server

File / directory Purpose
~/.bashrc, ~/.profile Shell settings, aliases, PATH. See environment variables
~/.ssh/ SSH keys, authorized_keys, known_hosts, config. See SSH keys
~/.bash_history Your command history
~/.gitconfig, .git/ Git settings and repository data
.env App secrets: database passwords, API keys
.htaccess Apache per-directory rules. See Apache .htaccess guide
.well-known/ Let’s Encrypt validation, security.txt
~/.config/, ~/.local/ Per-user app configuration and data
.dockerignore, .gitignore Files to exclude from images or Git

Security: dotfiles in web roots

Hidden files inside a website’s document root can be downloaded by anyone if the web server isn’t told otherwise. Bots constantly scan for /.env, /.git/config, and /.aws/credentials. Leaked .env files are a common way databases and API keys get stolen.

Block them in Nginx (but allow .well-known):

location ~ /\.(?!well-known) {
    deny all;
}

Check from outside:

curl -I https://example.com/.env          # should be 403 or 404
curl -I https://example.com/.git/config

Better still, keep .env and .git outside the public web root when the framework allows it. See secrets management and Nginx server blocks.

Permissions for sensitive dotfiles

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys ~/.ssh/id_ed25519
chmod 600 /var/www/app/.env

SSH refuses keys with permissions that are too open. See chmod.

Copying and archiving hidden files

The shell glob * doesn’t match hidden files:

cp -r /src/* /dst/          # misses .env, .htaccess!
cp -r /src/. /dst/          # copies everything, including hidden files
rsync -a /src/ /dst/        # rsync includes hidden files
tar czf site.tgz -C /var/www site   # archiving the directory includes hidden files

In Bash, shopt -s dotglob makes * include hidden files for the session. See wildcards and globbing and rsync examples.

Find hidden files

find /var/www -name ".*" -type f
find ~ -maxdepth 1 -name ".*"
du -sh ~/.[!.]* 2>/dev/null | sort -h      # sizes of hidden items in home

Large hidden directories (~/.cache, ~/.npm, ~/.local/share/Trash) can quietly fill disks. See Linux find command.

Hidden is not secret

The dot prefix only keeps files out of default listings. It provides no protection: anyone who can read the directory can list and open them with ls -a. Protect sensitive files with permissions, ownership, and by keeping them outside web roots, not by hiding them.

Quick reference

Task Command
Show hidden ls -la
Hide a file mv file .file
Copy including hidden cp -r src/. dst/ or rsync -a src/ dst/
Find hidden files find . -name ".*"
Block in Nginx location ~ /\.(?!well-known) { deny all; }

Related: Linux directory structure and Linux file permissions explained.

  • Linux
  • Beginners
  • Command Line