Paparan berkas for Cloudflare
critical5 checks
Repositories, environment files, database dumps and backups are the fastest path from reconnaissance to full compromise.
What Cloudflare must have
- /.git and /.svn not reachable
- /.env, /.env.local and config backups return 404
- No .sql, .zip or .tar.gz dumps in the web root
- Debug consoles and admin panels not publicly reachable
- Directory listing disabled
How to fix it
- 1Serve nothing from the web root that is not meant to be public
- 2Block dotfiles at the edge and rotate every secret that was exposed
Cloudflare context
CDN, DNS and WAF provider sitting in front of the origin.
Origin IPs must be firewalled to Cloudflare only, otherwise the WAF is bypassable by hitting the origin directly.