diff --git a/README.md b/README.md
index 7d97a33..bc062c6 100644
--- a/README.md
+++ b/README.md
@@ -63,9 +63,7 @@ curl -X DELETE \
 - [x] max file size
 - [x] .host in /data/xxx can be translated as host in GET /
 - [x] header to setup .host file instead of in archive
-- [ ] ignore .gitignore/.host etc at root
-- [ ] log visits (and store accross sessions)
-- [ ] deliver visits in /page/visits
+- [x] ignore .gitignore/.host etc at root
 - [ ] cerbot install in container + path env/arg
 - [ ] redirect /.well-known/acme-challenge to specific path
 - [ ] certbot/self-signed create/renew in specific dir
@@ -73,6 +71,8 @@ curl -X DELETE \
 - [ ] https mode w/ multiple hosts
 - [ ] restart command (on new/deleted host)
 - [ ] proper doc
+- [ ] log visits (and store accross sessions)
+- [ ] deliver visits in /page/visits
 
 ## Makefile targets
 
diff --git a/src/handler.py b/src/handler.py
index c0cad50..ddb2391 100644
--- a/src/handler.py
+++ b/src/handler.py
@@ -30,7 +30,10 @@ class StaplerRequestHandler(http.server.SimpleHTTPRequestHandler):
     def translate_path(self, path: str) -> str:
         if (page := self.registry.get_from_host(self.get_host())) is not None:
             path = f"/{page.path}" + path
-        return super().translate_path(path)
+        path = super().translate_path(path)
+        if os.path.basename(path).startswith("."):  # hidden files
+            return ""
+        return path
 
     def do_GET(self):
         if self.path == "/" and self.get_host() == self.default_host: