Published by the HackerMe team (Agura), the makers of HackerMe, a free automated website security scanner. The checks below are vendor-neutral. Each one is labeled: **safe on any public site * (it only reads what the site already publishes to everyone), your own sites only (it requests paths that could return sensitive data, so run it only on systems you own or have written permission to test), or maintainer check (it needs access to the server, the deployment pipeline or the repository).*

Files that were never meant to be public sometimes end up in the web root: a .git directory copied with a deployment, a .env file, a backup.zip left after a migration, or an editor copy such as config.php~ . The OWASP Web Security Testing Guide points out a specific risk with copies like login.asp.old : the server may return them as plain text instead of executing them, which hands out source code.…