.env and .git exposure checker
Some files must never be reachable from your live site: .env holds your secrets, and the .git folder holds your entire code history. This free checker requests them and tells you if they answer.
Run the check
What this checks
It makes a read-only request for a small set of files that must never be public, and requires the response to actually look like the real file (not a catch-all page) before reporting it. A public .env exposes every secret in it; a public .git folder lets someone download your whole source history.
Why it gets missed
A misconfigured host or a deploy that ships the whole project folder can expose these. If yours are exposed, stop serving them and rotate any secret that was in the .env, because you must assume it is already compromised.
See the full step-by-step fix, with a copy-paste block for your AI tool →