Sensitive Files
Configuration File Exposure Check
Learn to identify publicly exposed configuration files (like .env, config.php, settings.php) and protect them to avoid data leaks and takeovers.
What this test checks
This test checks whether sensitive configuration files (like .env, config.php, settings.php) are publicly accessible. These files often contain credentials, API keys, and critical application settings. Their exposure can lead to complete compromise of your site and data.
Our recommendation
Place all configuration files outside your site's public directory. If not possible, configure your server to block direct access (e.g., via .htaccess or permissions). In Laravel, the .env file must be inaccessible from the web – verify that your server configuration correctly blocks access.
Security tests
Read more
Header Security