Website Exposed Files Scanner

SiteLeak only checks publicly accessible URLs, using the same requests any browser or search engine crawler makes. We don't exploit vulnerabilities, bypass authentication, or access private systems. That said, we recommend only scanning domains you own or have permission to test.

Yes, 100% safe. SiteLeak is a passive, non-invasive scanner. It only checks publicly accessible URLs using standard HTTP requests (identical to what Google's crawler or any search engine does) to see if specific files exist. It does not perform active hacking, exploit code vulnerabilities, or load your server down, meaning there is zero risk to your site's speed, uptime, or security.

Scan results are stored securely so you can revisit or share your report via its unique link. Your findings are yours; we don't sell or share them, and you can request their deletion at any time.

We check 189 common vulnerability paths including .env files, .git histories, wp-config.php, internal AI prompts, .DS_Store files, and various other debug and configuration files that attackers look for.

Not at all. The scan acts like a regular web browser, simply making fast HTTP requests to known vulnerable paths. It does not perform invasive attacks or heavy fuzzing.

SiteLeak checks for passive file exposure, looking for things accidentally left publicly accessible. A full pentest actively probes for vulnerabilities, exploits logic flaws, and requires authorization. Think of us as the first 5 minutes of what a hacker does before they get serious.

Some servers return a 200 OK status for any URL, even ones that don't exist (called a "soft 404"). We flag these where possible, but if a result looks unexpected, try opening the URL directly in your browser to confirm.

After any deployment, dependency update, or infrastructure change. Misconfigured files most often appear right after pushes. Pro users get automated weekly scans so this happens without thinking about it.

Your report shows the exact URL, file type, severity level, and a plain-English explanation of what the risk is. Pro users also see a preview of the actual file contents and a recommended fix.

Yes, enter any subdomain directly (e.g. api.yourdomain.com). Each subdomain counts as a separate scan against your daily limit.

Free scans generate a unique URL you can send to a client or developer without them needing an account. It shows findings, severity ratings, and remediation notes. Pro reports are also exportable as PDF.

When you upgrade to Pro, we automate the scans to run weekly. If a new exposed file is discovered, we instantly send an alert to your email and Slack channel.

A .env file stores environment variables such as database passwords, API keys, and secret tokens. If publicly accessible, an attacker can use those credentials to access your database, cloud storage, email service, or payment processor within minutes.

If a .git folder is left accessible on a web server, attackers can reconstruct your entire source code, including commit history and any secrets that were ever committed, even if they were deleted later.