Quick answer
Configuration secrets, database exports, logs, and backup archives should not be publicly downloadable. Review what is stored under the web-accessible directory and what is included in source repositories or deployment packages.
Before you begin
Identify the website document root, deployment method, and approved secret-storage approach. Keep a recovery copy before moving files or changing application paths.
What to do
- Inventory environment files, configuration copies, SQL exports, logs, archives, and temporary diagnostic files. Do not print their secret contents while collecting the list.
- Store sensitive artifacts outside public web access where the application and hosting support it. Apply appropriate permissions and documented references.
- Exclude secrets and private exports from version control and public deployment packages. A file ignored by Git is not automatically protected from web access.
- Check that configuration and backup changes do not break the application or recovery process. Verify access controls using a safe method that does not expose secret values.
- Remove obsolete public diagnostics through an approved process and document any suspected prior exposure for review.
How to check the result
The application should work while unauthorized visitors cannot retrieve sensitive artifacts. Renaming a file or adding an unfamiliar extension is not a reliable access-control strategy.
If you need help
If a secret was exposed, request credential rotation and an exposure assessment rather than only deleting the visible copy. Provide file references and dates privately, never paste the credential into a support ticket or AI conversation.
Related help
- Store website backups outside public web access
- Share website errors with an AI assistant without exposing secrets
- Log PHP errors privately instead of displaying them to visitors
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
