# Files you forgot were public

Backups, settings files and folders that end up on a live site, and how a scan finds them before someone else does.

When a site is built and uploaded, more than the pages can come along. A backup of the database, a settings file, a folder listing or a log file can end up at a public address.

Nobody links to them, so they feel hidden. They aren't. Attackers try common file names on every site they visit, like `/backup.zip`, `/.env` or `/.git/`.

## What gets left behind

* **Settings files** with passwords for the database or email service.
* **Backups** with a full copy of your data.
* **Folder listings** that show every file in a folder, including ones you forgot.
* **Error and debug pages** that show how the site works inside.
* **Source code history** from the tool your developer uses to save changes.

Your `robots.txt` and sitemap can point to them too. They tell search engines what to skip or read, and anyone can read them.

## What to do

Delete the file from the live site, then ask whether anything in it needs replacing. A leaked password needs changing, not just hiding. Make sure your upload or build step only publishes the site itself, and turn off folder listings on your host.

A scan checks a short, careful list of common file names and never downloads more than it needs to confirm one is there.

> **Try it**
>
> Open [your things to fix](/app/findings) and look for anything about exposed files.