diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..4f78467
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,9 @@
+# For a complete list of core environment variables see
+# https://docs.silverstripe.org/en/4/getting_started/environment_management/#core-environment-variables
+
+# DB credentials
+SS_DATABASE_CLASS="MySQLPDODatabase"
+SS_DATABASE_SERVER="localhost"
+SS_DATABASE_USERNAME="<user>"
+SS_DATABASE_PASSWORD="<password>"
+SS_DATABASE_NAME="<database>"
diff --git a/.gitignore b/.gitignore
index 50e5d86..8a89502 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,8 @@
 # ignore cache folder
 /silverstripe-cache/
 
-# ignore all environment files
-_ss_environment.php
+# ignore .env file
+/.env
 
 # ignore build tools
 /tools/phing-metadata
diff --git a/.htaccess b/.htaccess
index 81693c6..f2c8d52 100644
--- a/.htaccess
+++ b/.htaccess
@@ -44,6 +44,7 @@ ErrorDocument 500 /assets/error-500.html
 	RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 	
 	# Deny access to potentially sensitive files and folders
+	RewriteRule ^\.env - [F,L,NC]
 	RewriteRule ^vendor(/|$) - [F,L,NC]
 	RewriteRule silverstripe-cache(/|$) - [F,L,NC]
 	RewriteRule composer\.(json|lock) - [F,L,NC]
diff --git a/web.config b/web.config
index 2c7d6a7..aa7f03b 100644
--- a/web.config
+++ b/web.config
@@ -4,6 +4,7 @@
 		<security>
 			<requestFiltering>
 				<hiddenSegments>
+					<add segment=".env" />
 					<add segment="silverstripe-cache" />
 					<add segment="vendor" />
 					<add segment="composer.json" />