Checks a site you own against a built-in list of over 2,000 commonly-leaked paths — .env files, database dumps, backup archives, feed-export scripts and more — plus anything you add below. Each path only gets a GET request initiated and its status code read; the response body itself is never downloaded, saved or cached.
wp-config.php, .git/config, cloud credential files, CI configs, …) with a generator that combines common backup directory names, filenames and archive extensions — the same style of patterns used by public web-recon wordlists such as SecLists.robots.txt once and skips any path it disallows. Each check only initiates a GET request and reads the status code it comes back with — the response body is never downloaded, saved or cached anywhere, by us or in your browser.200 (a “soft 404” — the site answers OK for everything instead of a real 404), the whole scan is skipped and reported as unreliable rather than risking a false “exposed” result.Deep scans are limited per address per day.