Data exposure
No public /wp-config.php.bak
Configuration files, backups and source code that should never be public.
Why it matters
Anyone who requests the file gets it - automated bots look for exactly these paths within hours of a site going live. Leaked credentials lead straight to a data breach.
How to fix it
Moderate · a few hours- Delete the file from the web root (or move it outside the public folder).
- Treat every password, key and token in it as compromised: rotate them now.
- Block dot-files and backup files in the web server so it cannot happen again.
- Check the web server access logs for earlier downloads of the path.
nginx
location ~ /\.(?!well-known) { deny all; return 404; }
location ~* \.(bak|sql|old|swp|orig)$ { deny all; return 404; }Apache
<FilesMatch "^\.(?!well-known)">
Require all denied
</FilesMatch>
<FilesMatch "\.(bak|sql|old|swp|orig)$">
Require all denied
</FilesMatch>How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free