Files that must never be public: .git folders, .env, backups and database dumps

The short answer: everything in the site folder can be requested by anyone who guesses the file name. Git folders, files with passwords (.env), copies like wp-config.php.bak and database dumps (.sql) get forgotten there. Bots look for those names every day. Check, delete and block.

What the site needs

What What to do
The .git folder It holds all the code and the history, including old passwords someone wrote and then deleted. your-domain.com/.git/config must not open.
The .env file The application’s passwords and keys: Keeping passwords out of your PHP code.
File copies wp-config.php.bak, config.old, a .zip of the site, “backup” folders: the server hands them over as text or as a download.
Database dumps An .sql file in the site folder is the whole database, one address away.
Logs and test tools debug.log, error_log, phpinfo.php, installers: Debug mode.

Getting started

1 Look in the File Manager (with “show hidden files”) for anything that is not the site: .git, .env, .sql, .zip, .bak, .old, .log.
2 Test in the browser a few addresses a bot would try (.env, .git/config, an .sql with the site’s name). You should see “404” or “403”, never the contents.
3 Move or delete what is not needed. Backups are kept outside the public folder: Your own backup.
4 Block what has to stay, by adding to .htaccess: <FilesMatch "\.(env|sql|bak|old|log)$">
Require all denied
</FilesMatch> and, for Git folders, a rule that refuses them.
5 If any secret was exposed, change it: the database password, API keys, whatever was in .env. Deleting the file does not undo what has already been read.
Deleting the file is not enough if someone already read it. If it was public, assume it was copied and change the passwords. Then check for strange access: After a hack.
To publish with Git without exposing the .git folder, see Git in cPanel. Security headers help, but do not replace this: Security headers.

Found something exposed and do not know how to close it? Open a ticket with the address, without copying the file’s contents.

Open a support ticket

SEE ALSO

Keeping passwords out of your PHP code: .env files and the right permissions

Git in cPanel: publishing your site from a repository

Making and keeping your own backup, and testing that it works

Security headers explained: what they do and how to add them in .htaccess

After a hack, which backup do you restore? Choosing a clean copy

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Content Security Policy: a first policy, tried out in report-only mode The short answer: Content Security Policy (CSP) is a header that tells the browser where the site may load scripts, styl...