Free Web Misconfiguration Scanner & Exposed File Detector

Scan your website for misconfigurations online. Detect exposed configuration files, backup files, .env files, admin panels, debug pages, database backups, and other sensitive directories that could expose credentials and compromise security.

https://

No credit card required • Instant results

Config Files

Detect exposed .env, config.php, settings.yml, and other configuration files

Backup Files

Find database dumps, SQL backups, .bak files, and backup directories

Directory Listing

Identify exposed directories with directory listing enabled

Admin Panels

Find exposed admin interfaces, debug pages, and control panels

Common Web Misconfigurations We Detect

Exposed Sensitive Files

  • .env and environment configuration files
  • config.php, settings.yml, app.config
  • Database connection strings
  • API keys and secrets in public files

Backup & Debug Files

  • SQL database dumps (.sql, .sql.gz)
  • Backup files (.bak, .backup, .old)
  • Debug and error logs
  • Version control files (.git, .svn)

Admin & Control Panels

  • phpMyAdmin and database admin tools
  • Admin login pages without protection
  • Debug interfaces and test pages
  • Server status and info pages

Directory Issues

  • Directory listing enabled
  • Exposed upload directories
  • Public backup directories
  • Accessible source code repositories

Why Misconfigurations Are Dangerous

Web misconfigurations are among the most common security vulnerabilities. A single exposed configuration file can reveal database passwords, API keys, and sensitive business logic. Attackers actively scan for these issues using automated tools.

Our scanner checks for over 100+ common misconfigurations including:

  • Environment files (.env, .env.local, .env.production)
  • Configuration backups and temporary files
  • Database dumps and SQL backups
  • Version control directories (.git, .svn, .hg)
  • Admin panels and debug interfaces
  • Directory listing vulnerabilities
170+
Exposed file and path patterns checked
CWE
Every pattern mapped to a weakness ID
Read-only
Nothing on your server is changed

Misconfiguration questions

What does the misconfiguration scanner check?

It requests 170+ paths that should never be public, such as .env and .git files, backups, database dumps, debug pages, admin panels and directory listings, and reports any that are reachable.

Why are exposed files so dangerous?

A single readable .env or .git directory can hand an attacker database passwords, API keys or your full source code. These files are found by automated scanners within hours of going live.

Is this scan safe to run on my site?

Yes. It only makes ordinary read requests for known paths. It never logs in, submits forms, uploads anything or tries to exploit what it finds.

How do I fix an exposed file?

Remove it from the web root, or block the path in your web server configuration. Then treat any secret it contained as compromised and rotate it, because you cannot know who already read it.

Is the misconfiguration scanner free?

Yes, with no registration.

This is one check. A full scan runs them all.

Free

The Misconfiguration Scanner covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.

Covered by this check

  • Exposed configuration files
  • Backup file detection
  • Environment file (.env) detection
  • Admin panel discovery
  • Directory listing check

Added by a full scan

  • SSL/TLS certificate validation
  • Security headers analysis
  • WordPress vulnerability scanning
  • Malware & script detection
  • DNS security (DNSSEC, CAA)
  • Domain reputation analysis
  • Certificate transparency logs
  • And 6+ more security checks
https://

Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.

Start free monitoring

More misconfiguration and infrastructure tools

IIS Scanner

Scan Microsoft IIS servers for vulnerabilities and known CVEs.

Exposed Secret Scanner

Detect API keys and credentials leaking in front-end code.

Is My Site Compromised?

Run a full-spectrum compromise check for malware, skimmers and intrusion signs.

Security Headers Checker

Audit CSP, HSTS and other HTTP security headers.

CORS Misconfiguration Checker

Detect arbitrary-origin reflection and credentialed CORS misconfigurations.