Every check ยท Exposed files
Directory listings
What it checks
/uploads/, /wp-content/uploads/, /backup/, /files/
Why it matters
Anyone can see every file in it, including ones nothing links to, such as backups and private uploads.
How to fix it
- Turn directory listings off: Options -Indexes in Apache, autoindex off in nginx.
- Check the files it listed for any that shouldn't be public, and remove them.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml .DS_Store files WordPress users