Server Configuration
Upload Folder Protection Check (.htaccess, index.html files)
Upload folders must contain protection files (.htaccess, index.html) to block direct access to uploaded files. Learn how to check and add them if necessary.
What this test checks
This test checks whether upload folders contain protection files like .htaccess (to block direct access or script execution) or index.html (to hide folder contents). Lack of these protections exposes your uploaded files to public access, which can allow sensitive file downloads or malicious script execution.
Our recommendation
Ensure every upload folder contains a .htaccess file with the 'Deny from all' directive (on Apache) or an empty index.html file. On Nginx, use a location rule to block access to upload folders. Also verify that uploaded files cannot be executed (e.g., by disabling PHP in upload folders).
Security tests
Read more
Sensitive Files