# Site Health Check for Publicly Exposed Sensitive Files

> Adds a Site Health test that checks whether files such as .env, debug.log, .git/HEAD and wp-config.php backups can be downloaded from your site by anyone, and flags them as critical.

- Type: PHP
- Runs: Admin only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: site-health, files, audit
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-exposed-files-site-health/

## Code

```php
// Paths (relative to the site root) that should never be public.
$wpide_sensitive_paths = array( '.env', '.git/HEAD', 'wp-content/debug.log', 'wp-config.php.bak', 'wp-config.php.old', 'wp-config.php~', 'wp-config.bak', 'backup.sql', 'database.sql', '.htpasswd', 'phpinfo.php' );

add_filter( 'site_status_tests', function ( $tests ) use ( $wpide_sensitive_paths ) {
    $tests['direct']['wpide_exposed_files'] = array(
        'label' => 'Exposed sensitive files',
        'test'  => function () use ( $wpide_sensitive_paths ) {
            $exposed = get_transient( 'wpide_exposed_files' );

            if ( false === $exposed ) {
                $exposed = array();
                foreach ( $wpide_sensitive_paths as $path ) {
                    $response = wp_remote_get( site_url( '/' . $path ), array(
                        'timeout'     => 4,
                        'redirection' => 0,
                        'sslverify'   => apply_filters( 'https_local_ssl_verify', false ),
                        'headers'     => array( 'Range' => 'bytes=0-255' ),
                    ) );
                    $code = (int) wp_remote_retrieve_response_code( $response );
                    $type = (string) wp_remote_retrieve_header( $response, 'content-type' );
                    if ( in_array( $code, array( 200, 206 ), true ) && false === stripos( $type, 'text/html' ) && '' !== wp_remote_retrieve_body( $response ) ) {
                        $exposed[] = $path;
                    }
                }
                set_transient( 'wpide_exposed_files', $exposed, 12 * HOUR_IN_SECONDS );
            }

            return array(
                'label'       => $exposed ? 'Sensitive files can be downloaded publicly' : 'No sensitive files are exposed',
                'status'      => $exposed ? 'critical' : 'good',
                'badge'       => array( 'label' => 'Security', 'color' => $exposed ? 'red' : 'blue' ),
                'description' => $exposed
                    ? '<p>' . esc_html( 'Anyone can download: ' . implode( ', ', $exposed ) . '. Delete these files or block access to them on your server.' ) . '</p>'
                    : '<p>None of the common sensitive files could be downloaded.</p>',
                'test'        => 'wpide_exposed_files',
            );
        },
    );

    return $tests;
} );
```

## Notes

Fix problems by deleting the files or blocking them in your server configuration; results are cached for 12 hours.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Site Health Check for Publicly Exposed Sensitive Files" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/