Every check ยท Exposed files
Database dumps
What it checks
/backup.sql, /dump.sql, /database.sql, /db.sql
Why it matters
Anyone can download the database's contents.
How to fix it
- Delete the dump from the web root.
- Keep backups somewhere the web server doesn't serve.
- If it held personal data, you may need to report a breach.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users