SEOlust logo SEOlust
Security & Privacy

Sensitive File Exposure Scanner

Scan a site for exposed sensitive files — .env, .git, backups, .htpasswd, phpinfo and more — graded exposed / protected / not found, with soft-404 detection. Free.

All tools
Only scan sites you own or are authorised to test.

💡 What this checks

  • Whether common leak-prone files are publicly reachable: .env, .git, backups, .htpasswd, phpinfo.php, and more.
  • Each path is graded: exposed (bad), protected (401/403), or not found (good).
  • A baseline request detects "soft 404s" so results stay accurate.

Free Sensitive File Exposure Scanner

Scan your site for accidentally exposed sensitive files — .env, .git, database backups, .htpasswd, phpinfo, and more. Each path is graded as exposed, protected, or not found, with a soft-404 baseline to keep results accurate. Only scan sites you own. Free, no sign-up.

What is a sensitive file exposure?

Websites often leave behind files that were never meant to be public: environment files with database passwords and API keys, an entire .git folder that leaks your source code, forgotten database dumps, config backups, and debug pages like phpinfo. If any of these are reachable over the web, an attacker can download them directly — no exploit required. This scanner checks the most common offenders so you can find and block them before someone else does.

How the scanner works

It runs quickly and carefully:

  • It requests a curated list of commonly-exposed paths on your domain.
  • It first fetches a random, non-existent path as a baseline to detect 'soft 404s'.
  • Each result is graded: exposed (publicly downloadable), protected (401/403), or not found.
  • All requests run in parallel, so a full scan takes just a few seconds.

The files it checks

The scan focuses on the highest-impact leaks:

  • .env and .env.local / .env.production — secrets, DB credentials, API keys.
  • .git/config and .git/HEAD — an exposed Git repo can reconstruct your source.
  • Config and site backups — wp-config.php.bak, backup.zip, database dumps.
  • .htpasswd and .aws/credentials — authentication and cloud secrets.
  • phpinfo.php, server-status, error_log — configuration and log leakage.
  • composer.json / package.json — lower-risk dependency disclosure.

Why the soft-404 baseline matters

Some servers return a 200 OK page for every URL, even ones that do not exist — a 'soft 404'. Without accounting for that, a scanner would wrongly report every path as exposed. This tool first requests a random path that cannot exist; if the server answers 200, it learns the soft-404 fingerprint and compares each real result against it, so you only see genuine exposures rather than false alarms.

How to fix an exposed file

If a file shows as exposed, take two steps. First, block access: deny dotfiles, backups, and version-control folders in your web server config, or move the file outside the document root entirely. Second, and just as important, treat any leaked secret as compromised — rotate the affected passwords, API keys, and tokens immediately, because you cannot know who already downloaded the file. Remove leftover .git directories and backup archives from production for good.

Pro tip

Prevention beats cleanup: add rules to your server config that deny requests for dotfiles (anything starting with a dot) and common backup extensions, keep your document root free of build artefacts and repos, and never deploy a .git folder. Only scan domains you own or are explicitly authorised to test. To also review response headers and CORS, pair this with our HTTP Response Headers Viewer and CORS Checker.

FAQ

Is this scanner free?
Yes. It is completely free and requires no account or sign-up.
Is it legal to scan a website?
Only scan sites you own or have explicit permission to test. This tool only requests known paths and does not exploit anything, but you should still have authorisation before scanning any site.
What does 'exposed' mean in the results?
It means the file returned a successful response and is publicly downloadable. For sensitive files like .env or database backups, that is a serious risk you should fix immediately.
What if a file shows as 'protected'?
A 401 or 403 status means the file exists but access is blocked, which is generally fine. Even so, consider removing files that do not need to be on the server at all.
Why do results account for soft 404s?
Some servers return 200 for missing pages. The scanner fetches a random non-existent path first to learn that pattern, so it does not report false exposures.
A secret was exposed — what should I do?
Block the file, then rotate every secret it contained (passwords, API keys, tokens) right away. Assume the data is already compromised, since you cannot tell who downloaded it.
How do I stop these files being exposed?
Configure your web server to deny dotfiles and backup extensions, keep repositories and build artefacts out of the web root, and never deploy a .git directory to production.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.