Files your website should not be serving

When a site is deployed, the host often uploads everything in the project folder. That can include files that were only ever meant for the developer: a file of passwords, internal scripts, a copy of the code history. If they are uploaded, anyone who guesses the address can open them.

Nobody notices until a stranger looks. Checking takes one minute.

The five addresses to open

Type each into a browser, after your domain:

• yourdomain.com/.env
• yourdomain.com/.git/config
• yourdomain.com/package.json
• yourdomain.com/scripts/
• Any other folder that holds scripts or backups

Each one should show “not found” (a 404 page). If any shows text or downloads a file, treat it as urgent.

What the files are

• .env is where a project keeps secrets: API keys, database passwords, email service keys.
• .git is the full history of the code, sometimes including old versions with secrets in them.
• package.json lists the tools the project uses. It is not secret, but it tells strangers exactly what to attack.
• Scripts are internal tools that were never meant to run for the public.

If a file is exposed

1. Change every secret in it. Assume it has been read. Replace the keys and passwords in the service that issued each one.
2. Block the file. Make sure .env, .git, package.json and the scripts folder are not part of the public site. Redeploy, then confirm each address shows “not found”.

On Vercel, the .vercelignore file lists what is left out of the upload. Other hosts have their own equivalent. Ask your host what it is.

3. Test again by opening the same five addresses.

Make it a habit

Recheck after every major redesign or change of host. New deploy settings often reset what the old ones blocked.

Keep secrets in your host’s settings for environment variables, not in files inside the project.

This is one of 52 checks in the Business Website Launch Checklist, in the chapter Domain and Hosting.