Sensitive File Exposure Check

Some of the most damaging breaches start with a single file that was never meant to be public: a .env with database credentials and API keys, a .git directory that lets anyone reconstruct your source code, or a backup.zip sitting in the web root. VitalSite probes more than 50 of these high-risk paths on every scan and flags any that return a live HTTP 200 as critical.

What VitalSite checks

We test paths across several categories, including:

• Secrets: /.env, /.env.local, /.env.production, /config.json, /secrets.json, /.aws/credentials
• Source control: /.git/config, /.git/HEAD, /.svn/entries
• Backups and dumps: /backup.zip, /database.sql, /dump.sql, /backup.tar.gz
• Server config: /.htaccess, /web.config, /wp-config.php.bak, /Dockerfile, /docker-compose.yml
• Diagnostics: /phpinfo.php, /server-status, /error_log

A file that returns 200 with real content is reported with its exact path so you can remove it immediately.

Why it matters

These files leak the keys to your entire system. An exposed .env can hand an attacker your database password, payment keys, and mail credentials in seconds. An exposed .git directory lets them download your full source history — including any secrets you committed and "removed" later. This is why exposed sensitive files are weighted as critical in your security score.

How to fix it

1. Remove the file from the web root. Secrets and backups should never live in a publicly served directory. Move them outside it.

2. Block dotfiles at the server. On Nginx:

location ~ /\.(env|git|htaccess|svn) { deny all; return 404; }

3. Rotate anything that leaked. If a .env was public, assume the credentials are compromised — rotate database passwords, API keys, and tokens now.

4. Stop committing secrets. Add .env and backup files to .gitignore and use environment variables instead.

Our guide on files that should never be public lists the full set and the fix for each web server.

Verify the fix

Re-scan after removing and blocking the files. The Sensitive File Exposure check should report that all probed paths are inaccessible. Treat any newly added admin tooling carefully — re-scan whenever you deploy new files.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.