Monitor types
Security scan monitors
A daily scan of your verified domains for exposed .env files, .git folders, database dumps and backups, plus a grade for your HTTP security headers.
- API type
security- You enter
- Verified domain
- Runs at most every
- 1 day
- Needs
- Security exposure scans add-on, Domain verification
Security scans need the Security exposure scans add-on ($6 a month) and can only target domains your organisation has verified with a DNS TXT record. Verification proves that you are allowed to scan the domain: see Verify a domain with a DNS TXT record. Security scan monitors cannot be created through the API.
Once a day, FastPing requests a list of well-known sensitive paths over HTTPS on the domain, without following redirects. A path only counts as exposed when it answers with status 200 and its content looks like the real file (for example KEY=value lines for .env, or ref: refs/ for .git/HEAD), so sites that answer every URL with their home page do not produce false findings.
| Path | Severity | What it exposes |
|---|---|---|
/.env | Critical | Environment file with secrets |
/.git/HEAD, /.git/config | Critical | Git repository: the source code can often be downloaded |
/.svn/entries | High | Subversion metadata |
/.DS_Store | Medium | macOS folder index that lists file names |
/.aws/credentials | Critical | AWS access keys |
/.npmrc | Critical | npm authentication token |
/docker-compose.yml | Medium | Docker Compose file (service layout, sometimes passwords) |
/wp-config.php.bak, /config.php.bak | Critical / High | Backups of configuration files with database passwords |
/backup.sql, /dump.sql | Critical | Database dumps |
/backup.zip | High | Backup archive |
/phpinfo.php | Medium | phpinfo() page with server internals |
/server-status | Medium | Apache server-status page with live requests |
/.htpasswd | Critical | Password hashes |
The same scan grades the HTTP security headers of the home page (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy), version numbers leaked in Server or X-Powered-By, cookie flags and whether plain HTTP redirects to HTTPS.
The monitor is down when any path is exposed (Exposed: /.env, /.git/HEAD), in warning when the header score is below 60 out of 100, and up otherwise (No exposures, headers grade B).
- Remove the file from the web root or block the path in your web server immediately.
- Treat every secret in it as compromised: rotate database passwords, API keys and tokens, even if you believe nobody downloaded the file.
- Check your access logs for earlier requests to the path.
- Fix the cause, typically a deployment that copies the whole project folder, so the file does not come back with the next release.
The free Security headers checker grades any public URL's security headers. The exposure scan itself only runs on verified domains.