Free Web Misconfiguration Scanner & Exposed File Detector

Scan your website for misconfigurations online. Detect exposed configuration files, backup files, .env files, admin panels, debug pages, database backups, and other sensitive directories that could expose credentials and compromise security.

https://

No credit card required • Instant results

Config Files

Detect exposed .env, config.php, settings.yml, and other configuration files

Backup Files

Find database dumps, SQL backups, .bak files, and backup directories

Directory Listing

Identify exposed directories with directory listing enabled

Admin Panels

Find exposed admin interfaces, debug pages, and control panels

Common Web Misconfigurations We Detect

Exposed Sensitive Files

  • .env and environment configuration files
  • config.php, settings.yml, app.config
  • Database connection strings
  • API keys and secrets in public files

Backup & Debug Files

  • SQL database dumps (.sql, .sql.gz)
  • Backup files (.bak, .backup, .old)
  • Debug and error logs
  • Version control files (.git, .svn)

Admin & Control Panels

  • phpMyAdmin and database admin tools
  • Admin login pages without protection
  • Debug interfaces and test pages
  • Server status and info pages

Directory Issues

  • Directory listing enabled
  • Exposed upload directories
  • Public backup directories
  • Accessible source code repositories

Why Misconfigurations Are Dangerous

Web misconfigurations are among the most common security vulnerabilities. A single exposed configuration file can reveal database passwords, API keys, and sensitive business logic. Attackers actively scan for these issues using automated tools.

Our scanner checks for over 100+ common misconfigurations including:

  • Environment files (.env, .env.local, .env.production)
  • Configuration backups and temporary files
  • Database dumps and SQL backups
  • Version control directories (.git, .svn, .hg)
  • Admin panels and debug interfaces
  • Directory listing vulnerabilities
45%
of breaches due to misconfiguration
100+
Misconfiguration patterns checked
<30s
Average scan completion time

More misconfiguration and infrastructure tools

IIS Scanner

Scan Microsoft IIS servers for vulnerabilities and known CVEs.

Exposed Secret Scanner

Detect API keys and credentials leaking in front-end code.

Is My Site Compromised?

Run a full-spectrum compromise check for malware, skimmers and intrusion signs.

Security Headers Checker

Audit CSP, HSTS and other HTTP security headers.

CORS Misconfiguration Checker

Detect arbitrary-origin reflection and credentialed CORS misconfigurations.

This is one layer of the scan

Free

This Misconfiguration Scanner scan covers one category. A full scan adds the checks it does not reach: exposed secrets, malicious scripts, and supply chain risks in your third-party code.