Is my .env file visible to the public?

Updated 2026-10-17

Short answer: it is if it sits in a folder your website serves and the server doesn't block it. Bots request /.env on every site, all day, because it usually holds database passwords and API keys in plain text.

How to check it yourself

  1. Open https://yourdomain.com/.env in a private window.
  2. It should return 404 or 403. If you see text like DB_PASSWORD=, it's public.
  3. Move the file above the public web folder, or block it in your server or host settings.
  4. If it was ever public, change every password and key in it, not just the file's location.

What Preventionlabs shows

On domains you've proven are yours, every report checks from the outside for files that should never be public: .env files, git repositories, config backups, server status pages and similar, and says plainly when one couldn't be read. For example, from a real report: "/wp-config.php.bak couldn't be read (HTTP 403)". See the fix guide for an exposed .env file.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers