{"id":19001,"date":"2026-10-22T21:02:24","date_gmt":"2026-10-22T18:02:24","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/exposed-sensitive-files-env-git-backups\/"},"modified":"2026-10-22T21:02:32","modified_gmt":"2026-10-22T18:02:32","password":"","slug":"exposed-sensitive-files-env-git-backups","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/exposed-sensitive-files-env-git-backups\/","title":{"rendered":"Exposed Sensitive Files on Your Site: .env, .git and Backups, and How to Hide Them"},"content":{"rendered":"
\n
In short<\/b>Every file inside your site folder public_html can be requested from a browser. If you leave a .env file with passwords, a .git folder with your full code, or a zipped backup there, anyone who knows the name can download it, and attackers try these names automatically on every site. The rule: keep in public_html only what visitors should see, and block access to whatever cannot be moved.<\/div>\n
\"Exposed<\/figure>\n

When a site is hacked we usually imagine a clever attack. But sometimes the attacker only types yoursite.com\/.env<\/span> into a browser and finds the database password and payment keys written in front of them. Automated scanners try dozens of well-known names on every site they find.<\/p>\n

The most dangerous exposed files<\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n
File<\/th>\nWhat it holds<\/th>\nWhere it comes from<\/th>\n<\/tr>\n<\/thead>\n
.env<\/span><\/td>\nDatabase passwords, API keys and payment keys.<\/td>\nLaravel, Node.js and other projects.<\/td>\n<\/tr>\n
The .git<\/span> folder<\/td>\nYour full code with its history, possibly including old passwords.<\/td>\nDeploying with Git straight into public_html.<\/td>\n<\/tr>\n
backup.zip<\/span>, site.tar.gz<\/span><\/td>\nA full copy of the site.<\/td>\nA manual backup left in the folder.<\/td>\n<\/tr>\n
*.sql<\/span><\/td>\nThe whole database.<\/td>\nA phpMyAdmin export never deleted.<\/td>\n<\/tr>\n
wp-config.php.bak<\/span><\/td>\nWordPress settings and the database password as plain text.<\/td>\nA copy made before editing. Read protecting wp-config.php<\/a>.<\/td>\n<\/tr>\n
phpinfo.php<\/span>, error_log<\/span><\/td>\nServer paths, software versions and errors.<\/td>\nTest files or error logs.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

How to check your site<\/h2>\n
    \n
  1. Open the cPanel File Manager:<\/b> Go to public_html and turn on \u201cshow hidden files\u201d in the settings, because files starting with a dot are hidden by default.<\/li>\n
  2. Look for risky extensions:<\/b> .zip<\/span>, .tar.gz<\/span>, .sql<\/span>, .bak<\/span>, .old<\/span>, .env<\/span>, and the .git<\/span> folder.<\/li>\n
  3. Test from the browser:<\/b> Open yoursite.com\/.env<\/span> and yoursite.com\/.git\/config<\/span>. If you see content instead of an error, the file is exposed.<\/li>\n
  4. Move or delete:<\/b> Download backups and SQL files to your computer, then delete them. Move .env outside public_html if your project allows it.<\/li>\n<\/ol>\n

    Block access to what must stay<\/h2>\n

    If a .env file or .git folder has to stay where it is, add these rules to your main .htaccess<\/code> file:<\/p>\n

    <FilesMatch "^\\.(env|git|htpasswd)|\\.(sql|bak|old|zip|tar|gz|log)$">\n  Require all denied\n<\/FilesMatch>\nRedirectMatch 404 \/\\.git<\/pre>\n
    If the files were already exposed:<\/b> blocking access now is not enough. Assume their contents were read, and change every password and key in them: the database, API keys and payment keys.<\/div>\n
    Habits that prevent the problem<\/h2>\n