Area: Exposed infrastructure

Indexed content

Searches the Common Crawl index and, if available, Brave Search for addresses of your domain that point to backups and data dumps, logs, code repositories, configuration files, sign-in or admin panels, API documentation, directory listings or internal documents. It only queries those sources (the search engines, not your server): it doesn't open any of those addresses or try others.

What it can report

Open each one to see what it means and how to fix it.

Sensitive addresses in a public web archive

What it means

Common Crawl, a public archive that crawls the web and that search and AI companies use, found addresses of your website that point to backups or data dumps: copies of your website or its database stored in a file, often left on the server after a migration. Being listed means the address was reachable by anyone when it was crawled. Ward didn't open any of them.

What could happen

A backup can hold everything: customer data, order history and the passwords of the people who sign in to your site. Anyone who finds the file can download it, no hacking needed. The capture can be old, so the file may no longer exist, but any data it held may already have been copied.

How an attacker would use it

Someone searches an archive of the web for backup-like file names. They find a copy of your database from an old migration, download it, and now have your customers' emails and the password hashes of your site.

How to fix it

Check, in your hosting file manager, that those files no longer exist, and delete them if they do.Ask your host or IT person if you're not sure how.
Work out what each file contained: customer data, passwords or just pages.
If it held passwords or keys, change them: website admin, database and any integrations.
From now on, keep backups outside the public part of the website.
If personal data was in the file, ask a lawyer whether you must notify anyone.

How to check it's fixed

Ward consults the latest crawl again. Old captures stay in the archive, so if the file is gone and the data was dealt with, you can mark the finding as accepted with a note. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Internal-looking documents in a search engine

What it means

A search engine currently shows documents that look internal by their name, such as invoices, payroll, estimates or contracts, hosted on your domain. Anyone who searches for your domain can find them. Ward only saw the search results and didn't open them.

What could happen

If any of them was never meant to be public, anyone can find it with a search, and a copy may already exist elsewhere. The severity is low unless the documents contain personal or financial data.

How an attacker would use it

Someone searches for “payroll” or “contract” together with your domain. A spreadsheet your company forgot to protect turns up, and with it names, salaries and bank details of your employees.

How to fix it

Open those documents from your side and check whether they are public on purpose.
Take down the ones that aren't, or protect them with a password, and tell the search engine to forget them.
Check where the file is stored: your website's uploads folder is public by default.
If personal data was exposed, ask a lawyer whether you must notify the people involved.

How to check it's fixed

Ward repeats the search. Search engines take days to drop a removed page, so ask them to remove it if you're in a hurry. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.