Sensitive Files
Authentication File Exposure Check (.htpasswd, .user.ini)
.htpasswd and .user.ini files contain passwords. Detect public exposure and learn how to secure them against unauthorised access.
What this test checks
This test checks whether authentication files like .htpasswd (used for password protection on Apache) or .user.ini (PHP configuration) are publicly accessible. These files contain hashed (or plaintext) passwords that, if exposed, could allow an attacker to crack credentials or bypass authentication. Their exposure is a critical flaw.
Our recommendation
Place .htpasswd, .user.ini files outside your site's public directory. If you must keep them within the public folder, protect them with a 'Deny from all' directive in a .htaccess file. In Nginx, configure a location rule to deny access. Verify that file permissions are restrictive (e.g., 600).
Security tests
Read more
Form Security