Files containing credentials.
WHAT THEY ARE
wp-config.php for WordPress Similar files for other applications Any file containing database passwords or API keys
WHY THEY MATTER
Anyone reading one has your database credentials.
HOW TO PROTECT THEM
Restrictive permissions: 600 or 640
Rules in .htaccess denying direct access Moving them above public_html, where the application supports it
WHAT TO NEVER DO
Leave a copy with a different extension in public_html
wp-config.php.bak or wp-config.old can be downloaded as plain text, revealing everything.
That is a common and serious mistake.
WHEN EDITING ONE
If you make a backup copy, put it outside public_html or delete it immediately afterwards.
AFTER ANY COMPROMISE
Change every credential in them.
WHAT TO CHECK
Search public_html for any file with a backup-style extension.
