Can people see my website's .git folder?

Updated 2026-10-17

Short answer: they can if you deployed by copying or pulling the whole project into the web folder and the server doesn't block it. A public .git folder lets anyone rebuild your source code, including any passwords or keys that were ever committed.

How to check it yourself

  1. Open https://yourdomain.com/.git/HEAD in a private window.
  2. It should return 404 or 403. If you see text like ref: refs/heads/main, the folder is public.
  3. Block access to .git in your server or host settings, or deploy only the built files.
  4. Change any password or key that was ever in the code.

What Preventionlabs shows

On domains you've proven are yours, every report checks from the outside for files that should never be public: .env files, git repositories, config backups, server status pages and similar, and says plainly when one couldn't be read. For example, from a real report: "/wp-config.php.bak couldn't be read (HTTP 403)". See the fix guide for an exposed .git folder.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers