Anything inside public_html is reachable by anyone who guesses the URL, whether or not you linked to it. Scanners guess these paths automatically.
FILES THAT MUST NOT BE PUBLIC
.env files containing database credentials and API keys Backup archives (site-backup.zip, database.sql) .git folders left behind by a deployment Configuration files with credentials Log files Old copies such as index.php.bak or wp-config.old
WHAT TO DO
Move them out of public_html entirely. Files in your home directory above public_html are not served to visitors. This is the safest option. Delete backups from the server once downloaded. Delete .git folders from production, or deploy in a way that does not place them there. Rename nothing to .bak inside a public folder. The server may serve it as plain text, exposing your database password.
BLOCKING ACCESS WITH .HTACCESS
Add to public_html/.htaccess:
<FilesMatch "\.(env|sql|bak|old|log|ini)$">
Require all denied
</FilesMatch>CHECKING
Try visiting the path yourself. If https://yourdomain.com/.env returns content rather than a Forbidden message, act immediately and treat the credentials as compromised.
