Check if your .env, .git or backup files are publicly exposed
Free tool that checks whether your website publicly serves sensitive files such as .env, .git, wp-config backups, SQL dumps, .npmrc or source maps, with content verification to avoid false positives.
Deploy scripts, misconfigured servers and copy-pasted folders regularly leave sensitive files on the public web. Automated bots look for these paths within minutes of a site going live.
Paths Wardzo checks
/.env, /.git/HEAD, /.git/config, /.DS_Store, /wp-config.php.bak, /wp-config.php~, /wp-config.php.save, /wp-config.old, /.htpasswd, /backup.sql, /dump.sql, /database.sql, /.npmrc, /docker-compose.yml, /phpinfo.php, /info.php and /server-status, plus any source maps referenced by your JavaScript.
How to fix exposed files
- Nginx: add
location ~ /\.(?!well-known) { deny all; }. - Apache: add a
<FilesMatch "^\.">block withRequire all denied. - Caddy: add a matcher for
/.env*and/.git*that responds with 404. - Vercel, Netlify and similar hosts: make sure the files are not inside the published output folder.
- After fixing, rotate every secret the file contained.
Checks included
| Check | Severity | How to fix |
|---|---|---|
| Environment file (.env) is publicly readable .env files usually contain database passwords and API keys. Anyone can download them. | critical | Remove the file from the web root or block dotfiles at the server, then rotate every secret it contained. |
| Git repository (.git) is publicly accessible Attackers can download your full source code and history, including old secrets. | critical | Block access to /.git at the web server (or deploy without the .git folder) and rotate any secrets in the history. |
| WordPress config backup is publicly readable Backup copies of wp-config.php are served as plain text and reveal database credentials and salts. | critical | Delete the backup file from the server and change the database password and WordPress salts. |
| Database dump is publicly downloadable SQL dumps can contain user data, password hashes and secrets. | critical | Delete the dump from the web root, store backups outside public folders, and review whether personal data was exposed. |
| .npmrc with an auth token is public npm tokens let attackers publish packages or read private ones as you. | critical | Remove the file from the web root, revoke the token on npmjs.com and create a new one. |
| .htpasswd file is publicly readable Password hashes can be cracked offline. | high | Move .htpasswd outside the web root and change the passwords. |
| phpinfo() page is public It reveals server paths, versions, modules and sometimes environment variables. | medium | Delete the phpinfo file from the server. |
| Apache server-status page is public It shows live requests, client IPs and internal URLs. | medium | Restrict /server-status to localhost or disable mod_status. |
| .DS_Store file is public macOS folder metadata lists file names in the folder, which can reveal hidden files. | low | Delete .DS_Store files from the server and add them to .gitignore. |
| docker-compose.yml is publicly readable It reveals your infrastructure and sometimes passwords. | medium | Remove the file from the web root. |
| Production source maps are public Source maps let anyone read your original, unminified source code, including comments and internal endpoints. | medium | Disable production source maps or upload them privately to your error tracker instead of serving them. |
This free tool runs the full passive Wardzo scan and shows these checks first. Nothing is stored in full: secrets are masked, and anonymous reports are deleted after 30 days.
Frequently asked questions
Does Wardzo brute-force paths on my server?
No. It requests a small fixed list of well-known paths, once each, with an identified user agent. It does not guess filenames.
Why are source maps a problem?
Production source maps let anyone reconstruct your original source code, including comments and internal logic. Wardzo only checks source maps that your JavaScript files reference.
Related
- What are source maps, and are public source maps a risk?
Source maps are .map files that map minified JavaScript back to the original source code. Publicly served production source maps expose your full front-end source.
- WordPress and site owner monitoring
Outside-in monitoring for WordPress and other long-running websites. Wardzo finds exposed config backups, SEO spam and cloaking, expiring SSL and downtime, without installing a plugin.
- Website security monitoring
Outside-in security monitoring for live websites. Wardzo finds leaked API keys in JavaScript, exposed .env and .git files, weak security headers, SSL problems and cloaking, then tells you how to fix them.