snag.page

Every check ยท Exposed files

wp-config.php copies

exposure/wp-config-backup

What it checks

/wp-config.php.bak, /wp-config.php~, /wp-config.php.save, /wp-config.php.old

Why it matters

It holds the WordPress database password and secret keys, readable as plain text.

How to fix it

  1. Delete the copy from the server.
  2. Change the database password, and make new secret keys at api.wordpress.org/secret-key/1.1/salt/.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users