Please add below code in your .htaccess file. It works also in localhost and Live server.
# Disable Directory listing
Options -Indexes
# block files which needs to be hidden, specify .example extension of the file
<Files ~ "\.(env|json|config.js|md|gitignore|gitattributes|lock)$">
Order allow,deny
Deny from all
</Files>
.htaccess file OR
SetEnv APP_ENV local
SetEnv APP_DEBUG true
SetEnv APP_KEY app_keyasfassafas
SetEnv DB_HOST localhost
SetEnv DB_DATABASE db_name
SetEnv DB_USERNAME root
SetEnv CACHE_DRIVER file
SetEnv SESSION_DRIVER file
SetEnv QUEUE_DRIVER sync