Private files

Some files should never leave the server. A copy of wp-config.php that an editor or FTP client left behind holds your database password in plain text. So does a .env file. A .git folder holds the site's code and its history, and an error log tells strangers how the site is built. Bots try these addresses on every site they find, all day long.

What WP Moo looks at

Once a day we try to open:

Copies of wp-config.php, like wp-config.php.bak, .old, .save, .orig and wp-config.php~, and wp-config.php itself in case PHP doesn't run it.
.env, the settings file of Bedrock and similar setups.
The .git folder, which some sites are deployed with.
error_log, the PHP error log many hosts write next to your site and in wp-admin.
The uploads folder, to see whether it lists every file in it.

A file only counts when its contents show what it is. A "page not found" page, your home page in its place or a refusal never counts, so a site that answers every address with a page doesn't get a false alarm. These are plain page visits, once a day. Some firewalls count requests for these files as scanning, so if yours blocks our checker, allow our addresses.

The WordPress check already looks at debug.log and readme.html, so they aren't repeated here.

What the problems mean

A config file with your site's secrets is public Urgent Delete leftover copies in your hosting panel's file manager right away, and block access to .env and wp-config.php on the server, or ask your host to. Then change the database password, because bots may already have downloaded it.

The site's code repository is public Important Block access to /.git on the server, or deploy without the .git folder.

Anyone can download the PHP error log Important Delete the file in your hosting panel's file manager, and ask your host to block access to error_log files or to write them outside the site.

Anyone can browse your uploads folder Notice Add Options -Indexes to .htaccess on Apache or LiteSpeed, or ask your host to switch off folder listings (autoindex off on nginx).

Out of the box: Urgent when a config file is public · Important when .git is public or error_log is public · Notice for an open uploads folder. What each priority means: Problem priority.

How to fix it

After a fix, the problem clears on the next daily run, or right away when you press Run checks on the site overview.

A config file with your site's secrets is public

Delete leftover copies like wp-config.php.bak in your hosting panel's file manager right away. A .env file and wp-config.php itself are needed, so ask your host or developer to block access to them instead. When the file held the database password, change it (and update it in wp-config.php or .env), because bots may already have downloaded the file.

The site's code repository is public

Ask your developer to block access to /.git on the server, or to deploy the site without the .git folder.

Anyone can download the PHP error log

Delete the error_log file in your hosting panel's file manager. It comes back with the next error, so ask your host to block access to error_log files or to write them outside the site.

Anyone can browse your uploads folder

On Apache or LiteSpeed, add Options -Indexes to the .htaccess file in the site's root folder. On nginx, or when you can't edit .htaccess, ask your host to switch off folder listings.

For your developer

Each run asks for the first 4,096 bytes (with a Range header) of /wp-config.php, /wp-config.php.bak, /wp-config.php.old, /wp-config.php.save, /wp-config.php.orig, /wp-config.php~, /.env, /.git/HEAD, /error_log, /wp-admin/error_log and /wp-content/uploads/, on the site's main address. When WordPress runs in a folder, like /blog, which we read from its login address, the wp-config.php files, both error_log files and the uploads folder are asked for in that folder too, for example /blog/wp-config.php.bak. .env and .git are only asked for at the root. To see what we see:

curl -sL -A 'WPMooBot/1.0 (+https://wp-moo.com/bot)' -r 0-4095 https://example.com/wp-config.php.bak

A file counts on a 200 or 206 at the path asked for, also after a redirect that kept the path and the host, with or without www, when its first bytes show it: define( 'DB_PASSWORD' for wp-config.php and its copies, three or more KEY=value lines and no HTML for .env, ref: refs/ or a commit hash for .git/HEAD, a line starting with PHP's log timestamp ([02-Nov-2026 10:00:00) for error_log, and an Index of / title for the uploads folder. A file that gets no answer, a server error or a firewall's block page keeps what the last run found, so one bad request doesn't clear a problem for a day. To block them (on nginx, keep the wp-config.php rule above your .php location, because nginx uses the first regex that matches):

# nginx
location ~ /\.(env|git) { deny all; }
location ~* /wp-config\.php { deny all; }
location ~* /error_log$ { deny all; }
autoindex off;

# Apache 2.4 (.htaccess)
Options -Indexes
<FilesMatch "^(\.env|wp-config\.php.*|error_log)$">
    Require all denied
</FilesMatch>
RedirectMatch 404 /\.git

Something unclear on this page? Email [email protected]