Configuration Exposure
Detect publicly accessible .env, manifest, configuration, and credential-bearing files.
WEBSITE SECURITY, MADE ACTIONABLE
Find the risks hiding in plain sight.
SiteThreat checks public website surfaces for exposed configuration files, backups, Git metadata, application logs, insecure headers, and other common weaknesses—then tells you exactly what to fix.
✓ No software installation✓ Live results✓ Clear remediation
Live Exposure Scan
example.com
SAFE/.env404
MEDIUM/composer.json200
HIGH/.git/HEAD200
SAFE/database.sql403
82Security Score
20+Exposure checks
3Hostname variants
LiveStreaming results
ActionableFix guidance
WHAT WE CHECK
Focused security checks that produce useful answers.
Source & Repository Leaks
Check for Git metadata and other development artifacts that should never be public.
Backups & Logs
Identify downloadable ZIP archives, SQL exports, debug logs, and application error files.
Security Headers
Review HSTS, CSP, clickjacking protection, MIME controls, and referrer policy.
Root, WWW & Mail
Test common hostname variants because each can route to a different server or document root.
Fix Instructions
Every finding includes a plain-English explanation and practical remediation guidance.
BUILT FOR ACTION
Not just a warning. A path to resolution.
Security reports often overwhelm site owners with technical labels. SiteThreat translates each result into priority, impact, and the specific next step—whether that means blocking a file, correcting a document root, rotating a credential, or adding a browser security header.
Start Scanning
CRITICAL
Environment file exposed
The server returned HTTP 200 for /.env. This file may contain live database, email, API, and encryption credentials.
What to do
Block all environment-file variants immediately, then rotate any exposed credentials.
READY TO CHECK YOUR SITE?
Scan My Website
Run a live scan in your browser.
Only scan domains you own or are explicitly authorized to assess.