Sensitive Files
Drupal Log File Exposure Check
Drupal log files can reveal sensitive site information. Check that they are not publicly accessible and learn how to secure them.
What this test checks
This test checks whether Drupal log files (in sites/default/logs/, logs/, watchdog.log, etc.) are publicly accessible. These logs contain detailed information about errors, admin accesses, SQL queries, and sometimes personal data or intrusion attempts. Their exposure can facilitate targeted attacks or information theft.
Our recommendation
Place Drupal log files outside the site's public directory. In Drupal, you can configure the log path via settings.php or the logging module. Use restrictive permissions and protect the log folder via .htaccess.
Security tests
Read more
Sensitive Files