snag.page

Every check ยท Exposed files

ELMAH error logs

exposure/elmah

What it checks

/elmah.axd

Why it matters

It lists the site's errors in full, which can include visitors' cookies and session ids.

How to fix it

  1. Set allowRemoteAccess="false" in the elmah security section of web.config.
  2. Or restrict elmah.axd to signed-in administrators.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users