Most website owners lock the front door and forget the side window. Your site's most sensitive files — the ones holding database passwords, API keys and secret tokens — are supposed to stay on the server, never served to visitors. But a single misconfiguration can put them one URL away from anyone who asks: yoursite.com/.env, a wp-config.php backup left in the public folder, a database dump saved "just for now", or a .git directory that lets anyone download your whole codebase history.
Attackers do not guess these paths one by one. They scan for them automatically, thousands of sites an hour, looking for exactly these files. A leaked .env or config backup hands over database credentials in plain text — no password guessing needed. From there it is a short step to reading customer data, changing content, or planting malware. The site can look perfectly normal while its keys are already public.
Check three things this week. First, try visiting your own site's sensitive paths — /.env, /wp-config.php.bak, /backup.sql — and make sure none of them load in a browser. Second, move backups and database dumps out of the public web folder entirely, and delete any .bak, .old or .zip copies of config files sitting on the server. Third, block the common ones at server level — .env, .git, .sql and config backups should return a 403 or 404 to everyone, with no exceptions.
A strong admin password means nothing if the password to the database is sitting in a file anyone can download. Run a free check of your site's exposure at https://vulnerabilitytools.com/ and make exposed-file checks part of your routine, alongside updates, backups and scans.
