What Sensitive Files Should Never Be Public on Your Web Server

Some files contain the keys to your entire application — database passwords, API keys, source code. If they're reachable over the web (returning HTTP 200), automated bots find them within minutes of going live. This is one of the most common and most damaging exposures.

Files attackers probe for

• /.env, /.env.local, /.env.production — environment secrets
• /.git/config, /.git/HEAD — full source history
• /wp-config.php.bak, /config.php — database credentials
• /backup.zip, /database.sql, /dump.sql — full data dumps
• /phpinfo.php, /.htpasswd, /.aws/credentials — server internals

VitalSite probes more than 50 of these paths on every scan and flags any that respond as critical.

How they get exposed

• Deploying with the .git folder included
• Leaving backup files in the web root
• Editors creating .bak / .swp copies
• Serving the project root instead of a public/ directory

The fix

1. Serve only a dedicated public directory; keep config and code above it.

2. Block dotfiles at the server. Nginx:

location ~ /\. { deny all; }

3. Never store backups in a web-accessible folder.

4. Re-scan after deploying to confirm nothing leaks.