Every check ยท Exposed files
.DS_Store files
What it checks
/.DS_Store
Why it matters
It lists the names of files in the folder, including ones nothing links to.
How to fix it
- Delete .DS_Store files from the server.
- Block files whose names start with a dot in the web server.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings WordPress users