Every check ยท Exposed files
Password files
What it checks
/.htpasswd
Why it matters
.htpasswd holds usernames and password hashes, which can be cracked.
How to fix it
- Move it out of the web root.
- Change the passwords in it.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users