One of the most common — and most preventable — security problems is simple: files that should be private are publicly accessible on your web server.

What counts as a sensitive file

  • Configuration files — .env, config.php, wp-config.php, database.yml
  • Version control folders — .git, .svn
  • Backup files — backup.zip, db_backup.sql, site.tar.gz
  • Log files — error.log, access.log, debug.log
  • Old or renamed files — index.php.bak, config.old
  • Admin or install scripts — phpinfo.php, install.php, setup.php

Why these files end up public

Usually accidental. A developer uploads a backup to restore it and forgets to delete it. An .env file ends up in the web root during deployment. A log file is written to a publicly accessible directory. Attackers scan for these constantly using automated tools.

What an attacker does with them

  • Downloads database credentials from a config file and logs in directly
  • Reconstructs source code from an exposed .git folder
  • Uses a backup file to get a full copy of your site and database

How Google can make it worse

Some sensitive files get indexed by search engines. A backup file left long enough in a public directory may appear in Google search results — reachable by anyone, not just attackers.

threatprobe.app's free scan checks for dozens of exposed paths — config files, backup files, version control folders, and installer scripts.

Scan your site for exposed files →