Every check ยท Exposed files
Apache server-status
What it checks
/server-status
Why it matters
It shows the requests being served, with visitors' addresses.
How to fix it
- Restrict /server-status to your own address with Require ip, or turn mod_status off.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users