You can add below code in .htaccess file to disable directory listing and restrict access of .env file:
# Disable Directory listing
Options -Indexes
# block files which needs to be hidden, specify .example extension of the file
Order allow,deny
Deny from all