Skip to content
Check a domain

Exposed files check

Verified sites · 5 checks

Check your website for sensitive files left onlineand close the doors you didn't mean to open.

Settings files, code folders and backups sometimes end up in the public web folder. Find them before anyone else does.

  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription

What we check

What we look at.Each with evidence and a fix.

Part of every Quick Scan on a verified domain, alongside the other checks.

  • Environment files

    Files such as .env that hold passwords and keys.

  • Code repository folders

    A public folder such as .git that gives away your source code.

  • Configuration and database backups

    Backup copies of your settings and data left in public.

  • Server information pages

    Pages that reveal how your server is set up.

  • System files

    Leftover files that list your folders.

Why it matters

Small settings.A big difference for your visitors.

  • Keep passwords private

    Spot a settings file before it is found.

  • Calm, exact results

    A file is reported only when we recognise what it is.

  • Quick to close

    Usually delete the file and add one server rule.

What a finding looks like

Plain English.With the evidence behind it.

Open the full sample report

X1 · exposed-files

Move a settings file out of your public web folder

High Confirmed Hours

What it means
A file named .env can be downloaded from your site. Files like this usually hold passwords and keys, so anyone who opens the address can read them.
Evidence
https://example.com/.env
found · 214 bytes
DB_PASSWORD=•••  (values hidden)
Fix
Delete the file from the public folder, block hidden files in your web server, and change the passwords and keys it held.

How to fix it

A few clear steps.In the order to take them.

Your report has the exact fix for your site, ready to forward to whoever looks after it.

  1. Delete the file from your public web folder and keep backups in private storage.

  2. Block hidden files in your web server or Cloudflare so they can never be served.

  3. Change any password, key or token that was in the file, then run another check.

Block hidden files in nginx
location ~ /\.(?!well-known) { deny all; }

Questions

Exposed files questions.

Something else? support@scandefend.com

Why do I need to verify my domain for this check?

This check is only run on domains your organisation has verified as yours. Verify once in your dashboard and it is included in every check.

Do you keep or show what is inside the files?

Never. We keep only the file's name, size and type. For an environment file we list the setting names, with every value hidden.

What if you find nothing?

Then none of the common sensitive files we look for were left online, which is the result you want. Unusual files sit outside a Quick Scan.

Keep exploring

Also useful: What we check Sample report Pricing For developers

See what your website shows.Know what to fix first.

See pricing