Sensitive file public

Why it matters

Such files often contain passwords for the database or mail, or show how the site is built. With them an intruder does not need to guess anything. This is the most urgent finding of the security check.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. At the end it asks five addresses that should never be public, such as /.env, /.git/HEAD, a backup of wp-config.php, debug.log and phpinfo.php. It only reports a file when the content really is that file, not a normal page. A firewall that steps in here is a good sign.

Common causes

• A backup or test file left behind after a change
• Debug logging switched on and never switched off
• A code folder uploaded together with the site

How to fix it

1. Remove the file right away, or move it outside the web folder.
2. Did it contain a password? Change that password immediately.
3. Switch off debug logging on the live site.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "A file is open that nobody should see". When everything is in order, the report says: "No sensitive files are open to the public".