Files you forgot were public
Backups, settings files and folders that end up on a live site, and how a scan finds them before someone else does.
When a site is built and uploaded, more than the pages can come along. A backup of the database, a settings file, a folder listing or a log file can end up at a public address.
Nobody links to them, so they feel hidden. They aren't. Attackers try common file names on every site they visit, like /backup.zip, /.env or /.git/.
What gets left behind
- Settings files with passwords for the database or email service.
- Backups with a full copy of your data.
- Folder listings that show every file in a folder, including ones you forgot.
- Error and debug pages that show how the site works inside.
- Source code history from the tool your developer uses to save changes.
Your robots.txt and sitemap can point to them too. They tell search engines what to skip or read, and anyone can read them.
What to do
Delete the file from the live site, then ask whether anything in it needs replacing. A leaked password needs changing, not just hiding. Make sure your upload or build step only publishes the site itself, and turn off folder listings on your host.
A scan checks a short, careful list of common file names and never downloads more than it needs to confirm one is there.
Was this helpful?