In shortEvery file inside your site folder public_html can be requested from a browser. If you leave a .env file with passwords, a .git folder with your full code, or a zipped backup there, anyone who knows the name can download it, and attackers try these names automatically on every site. The rule: keep in public_html only what visitors should see, and block access to whatever cannot be moved.
When a site is hacked we usually imagine a clever attack. But sometimes the attacker only types yoursite.com/.env into a browser and finds the database password and payment keys written in front of them. Automated scanners try dozens of well-known names on every site they find.
The most dangerous exposed files #
| File | What it holds | Where it comes from |
|---|---|---|
| .env | Database passwords, API keys and payment keys. | Laravel, Node.js and other projects. |
| The .git folder | Your full code with its history, possibly including old passwords. | Deploying with Git straight into public_html. |
| backup.zip, site.tar.gz | A full copy of the site. | A manual backup left in the folder. |
| *.sql | The whole database. | A phpMyAdmin export never deleted. |
| wp-config.php.bak | WordPress settings and the database password as plain text. | A copy made before editing. Read protecting wp-config.php. |
| phpinfo.php, error_log | Server paths, software versions and errors. | Test files or error logs. |
How to check your site #
- Open the cPanel File Manager: Go to public_html and turn on “show hidden files” in the settings, because files starting with a dot are hidden by default.
- Look for risky extensions: .zip, .tar.gz, .sql, .bak, .old, .env, and the .git folder.
- Test from the browser: Open yoursite.com/.env and yoursite.com/.git/config. If you see content instead of an error, the file is exposed.
- Move or delete: Download backups and SQL files to your computer, then delete them. Move .env outside public_html if your project allows it.
Block access to what must stay #
If a .env file or .git folder has to stay where it is, add these rules to your main .htaccess file:
<FilesMatch "^\.(env|git|htpasswd)|\.(sql|bak|old|zip|tar|gz|log)$"> Require all denied </FilesMatch> RedirectMatch 404 /\.git
If the files were already exposed: blocking access now is not enough. Assume their contents were read, and change every password and key in them: the database, API keys and payment keys.
Habits that prevent the problem #
- Keep backups in a folder outside public_html, or download them straight to your computer.
- When deploying from Git, copy only the files, not the .git folder.
- Delete test files such as phpinfo.php after using them.
- Keep debug mode off on the live site.
How Hyyat Host protects your site #
- ModSecurity and Imunify360 rules block many automated scans for well-known sensitive files.
- ImunifyAV scans files daily and detects new malicious files.
- If you find a sensitive file that was exposed, open a ticket and we will help you check the logs to see whether anyone downloaded it.
Also read secure file permissions.
Frequently asked questions #
How do I know whether someone downloaded the exposed file?
Search the visitor logs in cPanel for the file name. If there are successful requests, assume it was downloaded and change the passwords.
Will deleting the .git folder break my site?
No, the site does not need it to run. It is only used by the code management tool.
Where should I keep the backup if not in public_html?
In a folder in your account outside public_html, or download it to your computer or external storage.
Related guides
- How to Protect wp-config.php in WordPress: 7 Steps to Secure Your Most Important File
- Protecting Your Website Database and phpMyAdmin: Users, Privileges and Passwords
- Secure File Permissions for Your Website: When to Use 644 and 755, and Why to Avoid 777
- How to Tell if Your Website Is Hacked: 10 Signs and Quick Checks
