Free check

Is your .git folder public?

If your site's .git folder is reachable, anyone can rebuild your entire source code and its history, including any passwords or keys that were ever committed, even ones you later deleted.

Why it matters

Free tools can download a public .git folder and reconstruct the whole repository in seconds. Attackers then read your code for vulnerabilities and search the history for credentials.

It usually happens when a site is deployed by cloning the repository onto the server and serving it directly.

What this check looks at

/.git/HEAD, /.git/config, /.git/logs/HEAD and /.git/index
Each response's content (a real HEAD file starts with "ref: refs/"), so catch-all pages don't cause false alarms

How to fix it

If the folder was public, assume the source code and its full history were copied. Rotate any secret that was ever committed.

Nginx

# Deny every dotfile and dot-folder except /.well-known
location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

Apache (.htaccess)

# Deny every dotfile and dot-folder except /.well-known
RedirectMatch 404 /\.(?!well-known)

Vercel, Netlify, Cloudflare Pages

These hosts only serve your build output folder (for example dist/, build/, out/ or public/).
Make sure .env and .git are never copied into that folder, and don't set the
output directory to your project root.

Express

// Serve static files without exposing dotfiles
app.use(express.static("public", { dotfiles: "deny" }));

Questions

Is it a problem if my repository is already public on GitHub?

Less so for the code itself, but the exposed folder can include local history, unpushed branches and config with credentials. Block it either way.

How do I deploy without exposing .git?

Deploy only your build output, use a host that builds from your repository, or point your web server at a public subfolder instead of the repository root.