Guide · 3 min read
Block exposed .git, .env and backup files
A forgotten .env or backup.sql in your web root can give away every password and API key you have. It takes a minute to check and a few lines to block.
Check your own site
Each of these should return 403 or 404, never 200:
shell
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.env
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.git/HEAD
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/backup.sqlOnly check sites you own. HackGrade’s deep scan tests many more paths, after you verify ownership.
Block them on nginx
nginx
# hidden files and folders (.git, .env, .htpasswd), but keep /.well-known working
location ~ /\.(?!well-known/) { deny all; }
# backups and dumps
location ~* \.(sql|bak|old|orig|swp|log)$ { deny all; }Block them on Apache
.htaccess
RedirectMatch 404 "/\.(git|svn|hg)(/|$)"
<FilesMatch "(^\.env|\.(sql|bak|old|orig|swp|log)$|~$)">
Require all denied
</FilesMatch>
Options -IndexesIf something was exposed
- Delete the file from the web root. Keep backups outside it.
- Assume the contents were copied: change database passwords and rotate every API key and token in it.
- For an exposed
.gitfolder, also review the commit history for secrets that were ever committed.