Can anyone download your .env or .git files?
Files that should never be public but sometimes are: .env files, the .git folder, .DS_Store files, database dumps and backups, and phpinfo pages.
Why it matters
A .env file usually holds database passwords and API keys. An exposed .git folder can give away your complete source code and its history. Backups can contain your whole database. These are among the most damaging leaks a site can have, and automated scanners look for them constantly.
How a survey checks it
Verified check: runs once you prove you own the site.
This is a verified check: it only runs once you have proved you own the site. We request a fixed list of addresses and confirm each file by its contents, so a page that answers every address does not count. We never keep what a file contains; for a .env file we note only the names of its settings.
How to fix it
- Remove the file from your public folder and make sure your deploy does not copy it there again.
- Rotate every password and key the file contained. Assume they were copied.
- Block dot-files and backup files at your web server or host, so a mistake later is not served.
Prefer us to do it? Ask for a fix quote
Common questions
Why is this a verified check only?
Asking for files that are not linked from your site goes beyond what a visitor would do, so we only do it for owners who have asked us to.
How would a .env file end up public?
Usually by deploying a whole project folder to a host that serves every file in it, instead of only the build output.