Some of the worst website breaches start with no hacking at all. Someone simply downloads a file that was never supposed to be public: a configuration file with database credentials, a backup an editor left behind, or a readme that spells out exactly which software version is running.

The usual suspects

  • .env files. Modern apps keep secrets in a file called .env: database passwords, API keys, mail credentials. If deployment puts it inside the public web root, anyone can fetch yourdomain.com/.env and read every secret you have.
  • wp-config backups. Editing wp-config.php often leaves copies behind: wp-config.php.bak, wp-config.php.old, wp-config.php~. The original is protected because PHP executes it. The copies are plain text, and they contain your database password and salts.
  • readme.html. WordPress ships one in the web root. It is harmless by itself but advertises your exact version, which turns generic attackers into targeted ones.
  • .git directories. A deployed repository can expose your full source history, including secrets committed years ago.

How they leak

Almost never through an attack. They leak through routine work: an FTP upload that included everything, a text editor that saves backup copies, a migration plugin that unpacked an archive into the web root, a deploy script that copies the whole project folder. Nobody notices, because the site works fine either way.

How to check

Try fetching the files yourself:

curl -sI https://yourdomain.com/.env
curl -sI https://yourdomain.com/wp-config.php.bak
curl -sI https://yourdomain.com/readme.html

Anything that answers 200 OK is publicly downloadable. A free AuditMerlin scan checks these paths and more with ordinary public requests, the same way an attacker would look, and never touches anything else.

How to fix it

Delete what should not be there, then block the patterns at the edge. If your site runs behind Cloudflare, a WAF rule that blocks requests for .env, *.bak and readme.html takes a few minutes and covers files you have not created yet. On the server, deny access to hidden files and backup extensions in your web server config.