I'm playing around with the idea of using Git for deployment and updates of my web applications, but the problem is that by doing it the way I'm doing it, the .git directory (and therefore all my source code) would be accessible via HTTP. This is what is holding me back from really implementing this idea.
How do I prevent HTTP access to my Git repository?!
Probably the best way is to not make the Git repo itself your web root, but rather a copy of it (made, perhaps, with git archive). You could also place the .git directory somewhere else in your file system, and then set the core.worktree option to your web root, so when you check out the files they will be written there (but not the .git directory itself).
You can also use a htaccess directive to forbid access to .git from the web.