Sensitive Files
Drupal settings.php File Access Check
The settings.php file contains Drupal database credentials. Verify it is not publicly accessible and learn how to secure it effectively.
What this test checks
This test checks whether the Drupal configuration file (sites/default/settings.php) is publicly accessible. This file contains database connection credentials, hash salts, and security settings for your Drupal site. Its exposure allows an attacker to steal your data and take control of your site.
Our recommendation
Ensure that sites/default/settings.php is not accessible from the web. Use restrictive permissions (chmod 644) and protect the /sites/default/ folder with a .htaccess file (Deny from all). Regularly verify its accessibility by trying to access it via a browser.
Security tests
Read more
Form Security