Files that must never be publicly reachable.
WHAT MUST NOT BE PUBLIC
Configuration files containing database credentials .env files Backup archives .git directories Log files Old copies such as config.php.bak
WHY
Anyone can request any path. Scanners guess these automatically, and a .env file returning content hands over your database credentials.
A renamed file with a .bak extension is frequently served as plain text, which is worse than the original.
WHAT TO DO
Move them above public_html where the application allows it. Files in your home directory are not served to visitors. Delete backups from the server once downloaded. Remove .git directories from production. Block access in .htaccess for anything that must stay in place.
CHECKING
Visit the paths yourself. https://yourdomain.com/.env should return Forbidden or Not Found, never content.
Do this after every deployment.
IF SOMETHING WAS EXPOSED
Treat the credentials as compromised and change them immediately.
