How to protect .env, .git and other sensitive files
Configuration and repository files left readable expose passwords and source code. Block them at the web server.
Step by step, with screenshots: WordPress backup: a plan you have actually test-restored →
Check your own site
Runs these 3 checks and the other 190, free, in about 45 seconds.
Or run only this check with the free WordPress health check or the free Hacked site & SEO spam checker.
What it is
Exposed sensitive files are configuration and version-control files that a web server hands out to anyone who asks for them by name, most often /.env, which holds database passwords and API keys, and the /.git/ folder, which contains a site's full source code and history.
Bots request these paths on every site they find, so an exposed file is usually discovered within days, and the secrets in it let attackers into your database, email service or cloud account. getReport requests a small fixed list of these paths and fails the check only when one returns content that looks like credentials or a repository. Your site is OK when those paths return 403 or 404 and the files live outside the web root.
What a passing site looks like
- No sensitive files are readablefail · −15 ptseffort S
- No public backup of wp-config.phpfail · −15 ptseffort S
- The WordPress debug log is not publicfail · −10 ptseffort S
1. Sensitive files are readable by anyone
Why it matters. /.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed. Both are the first things an automated scanner asks for.
- Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).
- Move .env outside the web root and rotate every credential in it; assume the file has already been copied.
2. A backup of wp-config.php is public
Why it matters. A backup copy of wp-config.php is served as plain text instead of being run as PHP, so anyone can read the database name, user and password and the security keys.
- Delete the backup file from the server now, then change the database password and generate new security keys in wp-config.php.
- Block direct access to .bak, .old, .save and ~ files in the server configuration.
In a report the technical detail reads: A copy of wp-config.php answers 200 with configuration in it. The file name and contents are not stored.
3. The WordPress debug log is public
Why it matters. The debug log records PHP errors with server paths, plugin names and sometimes data from forms or queries. Anyone can read it, and attackers look for it.
- Set WP_DEBUG_LOG to false, or to a path outside the web root, in wp-config.php, then delete wp-content/debug.log.
- Block direct access to .log files in the server configuration, so a new log cannot be read either.
In a report the technical detail reads: /wp-content/debug.log answers 200 and reads as a PHP error log. Its contents are not stored.
Questions people ask
What is a .env file?
A .env file is a plain-text file of settings in the form NAME=value that many frameworks, including Laravel, Symfony and Node.js apps, load when they start. It typically holds database passwords, API keys, mail credentials and secret keys, which is why it must never be downloadable. It belongs outside the public web folder or behind a server rule that denies access.
Why is an exposed .env file dangerous?
Because it contains working passwords and keys. With them, an attacker can read or delete your database, send email from your account, run up charges on paid APIs and cloud services, or sign session cookies and log in as anyone. If yours was ever readable, block it and then change every secret in it, since you cannot know who downloaded it.
What does "web server exposed Git repository" mean?
It means the /.git/ folder was uploaded to the web server along with the site, so anyone can download it and rebuild your complete source code and commit history, including passwords that were committed once and deleted later. Deploy without the .git folder, or deny every path that starts with /.git at the web server.