1dollar.website

Exposed .env or .git file? What to do now

If anyone can download your .env file or .git folder from your website, treat every password and key in them as stolen: change them first, then delete the files from your web folder and block them so they can't come back. The steps for your server are below.

Last updated October 26, 2026

Not sure whether your site has this?

Paste your address. The checkup is free and shows what's flagged.

What our checkup looks for

Our free checkup asks your site for a short list of files that should never be public, like /.env, /.git/config and /.DS_Store, and only flags one if what comes back really is that file. It also checks for open directory listings and leftover debug pages like phpinfo.php. It never records the values inside a file it finds.

Exposed .env or .git: change your passwords first

A .env file usually holds your database password, payment keys and API keys. A .git folder lets anyone rebuild your site's full source code and history, including any password that was ever committed. Bots scan for both constantly.

Deleting the file isn't enough, because it may already have been copied. Change every password and key it contained first, then remove it from your web folder and add the rule for your server so hidden files can never be served again.

Choose where your site runs

Nginx
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. Delete the exposed file or folder from your web root.
  3. Add this rule to your server block so hidden files can never be served again, then reload Nginx.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
nginx
location ~ /\.(?!well-known) {
    deny all;
}
Apache
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. Delete the exposed file or folder from your web root.
  3. Add this to your .htaccess (Apache) so hidden files are always blocked.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
apache
<FilesMatch "^\.(?!well-known)">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git
WordPress
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. Delete the exposed file or folder from your web root.
  3. Add this to your .htaccess (Apache) so hidden files are always blocked.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
apache
<FilesMatch "^\.(?!well-known)">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git
IIS
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. Delete the exposed file or folder from your site root.
  3. Add this to web.config inside <system.webServer> to block hidden folders.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
xml
<security>
  <requestFiltering>
    <hiddenSegments>
      <add segment=".git" />
      <add segment=".env" />
    </hiddenSegments>
  </requestFiltering>
</security>
Netlify
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. This file is being deployed as part of your site. Remove it from the folder you publish (e.g. public/ or the build output).
  3. Check your build settings so the project root isn't deployed as-is, then redeploy.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
Copy this
# Make sure files like these never reach your publish folder
.env
.env.*
.git/
Vercel
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. This file is being deployed as part of your site. Remove it from the folder you publish (e.g. public/ or the build output).
  3. Check your build settings so the project root isn't deployed as-is, then redeploy.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
Copy this
# Make sure files like these never reach your publish folder
.env
.env.*
.git/
GitHub Pages
  1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
  2. This file is being deployed as part of your site. Remove it from the folder you publish (e.g. public/ or the build output).
  3. Check your build settings so the project root isn't deployed as-is, then redeploy.
  4. Afterwards, open the address again in a private window and confirm it shows an error page.
Copy this
# Make sure files like these never reach your publish folder
.env
.env.*
.git/

Turn off directory listings

When a folder has no index page, some servers show a list of every file in it. Anyone can then browse uploads and backups you never linked to. One line turns it off.

Choose where your site runs

Nginx
  1. Make sure directory listings are off in your server block:
nginx
autoindex off;
Apache
  1. Add this line to the .htaccess file in your site root:
apache
Options -Indexes

Remove debug pages

phpinfo.php and Apache's server-status page are debugging tools. The first reveals your server's whole configuration; the second shows live requests, including visitors' addresses. Neither should be public.

Choose where your site runs

phpinfo.php
  1. Delete phpinfo.php from your web root. It was meant for debugging only and isn't needed by your site.
bash
rm /path/to/webroot/phpinfo.php
Apache server-status
  1. Restrict the status page to the server itself in your Apache config, then reload.
apache
<Location "/server-status">
  SetHandler server-status
  Require local
</Location>

How to check it worked

Both should print 403 or 404, not 200. Try it in a private browser window too.

bash
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.env
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.git/config

Common mistakes

  • Deleting the file but not changing the keys in it. Assume it was already copied.
  • Blocking .env but not .env.production, .env.local or backup copies like .env.bak.
  • Blocking every hidden path, including /.well-known/, which certificates and security.txt need. The rules below keep it open.
  • Deploying your whole project folder on a static host instead of only the build output.

What this can't tell you

We only check a short list of well-known file names. A clean result doesn't rule out a private file with an unusual name.

Check your own site, free

The free checkup shows how many results are flagged and how serious. For $1, the report picks the ones that matter for your site and writes each fix for your platform, with your own domain filled in.