snag.page

Every check ยท Exposed files

Exposed files

exposure/files

What it checks

49 well-known paths that shouldn't be public, from /.git/HEAD to /.env.

Why it matters

Files like these give away source code, passwords and keys.

How to fix it

  1. Block files whose names start with a dot, and backups and dumps, in the web server.
  2. Deploy only what the site needs, built into a separate folder.
  3. Change any password or key a public file held.

Check a site for this and everything else: snag.page. More on exposed files: Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users