Sensitive paths
Exposed files check
Files such as .env, .git and backups hold passwords and source code. They should never be downloadable from your website.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We request about 120 well-known private paths (environment files, Git folders, CI configuration, database backups, debug pages, API documentation) and check whether any answer with real content. Because that is the same traffic an attacker's scan makes, we only do it on a domain you have verified you own: with a DNS record, a file or an email link, or because your verified sign-in email is at it. It runs in the domain's full scan, not in the quick one-off tools.
Why it matters to your business
An exposed .env or backup file can contain database passwords, API keys and email credentials, and automated bots probe websites for them constantly. One exposed file can hand over everything the site connects to.
How to fix it
- Delete the files from the web root; they should never be deployed there.
- Block the paths at your CDN or server (deny /.env, /.git and backup extensions).
- Change every password and key the files contained, and assume they were already copied.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.
Keep an eye on it
A one-off check tells you how things stand today. On Starter and up, DomainGuard re-checks the domains it watches every day and alerts you in the app when something important changes, so you hear about it before a customer does.