Every check ยท Exposed files
PHP error logs
What it checks
/wp-content/debug.log, /error_log
Why it matters
It shows the server's file paths and the site's errors, and sometimes the data that caused them.
How to fix it
- Delete the log, and block .log files and error_log in the web server.
- In WordPress, turn WP_DEBUG_LOG off in production, or point it at a file outside the web root.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users