snag.page

Every check ยท Exposed files

Editor upload settings

exposure/sftp-config

What it checks

/.vscode/sftp.json, /sftp-config.json

Why it matters

The file holds the server's address and the login used to upload the site.

How to fix it

  1. Delete the file from the server.
  2. Change the password or key it names.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users