Launching soon
Your website is serving files you forgot about.
Forgotten Files checks your sites from the outside every week, the same way an attacker would: exposed backups, deployed .git folders, leftover debug files, expiring certificates, broken email authentication. When something changes, you get a plain-English alert with the exact fix for your stack.
No plugin to install. Works on any host: cPanel, WordPress, Laravel, plain PHP, static sites.
HIGH /backup-2024-03.sql.gz is publicly downloadable (48 MB) HIGH /.git/config is readable: full source history can be rebuilt MED PHP 8.0 reported in X-Powered-By (end of life since Nov 2023) MED DMARC record missing: anyone can send mail as this domain OK TLS certificate valid for 61 more days OK No directory listings, no phpinfo(), no error_log in docroot
What it finds
The things that get left behind after a migration, a quick fix or a late-night deploy. None of them show up in a WordPress plugin, because they live outside WordPress.
Backups in the web root
Database dumps and site archives anyone can download, often with every password in them.
Source and secrets
Deployed repositories and environment files that expose code, API keys and database credentials.
Debug leftovers
Diagnostic pages and logs that map out your server for whoever finds them.
Keys in the front end
Payment and API secret keys shipped inside public JavaScript.
Email authentication
Missing or broken records that let others spoof your domain and push your own mail into spam.
Expiry and end of life
Certificates and domains about to expire, outdated PHP, and dangling DNS records open to takeover.
How it works
Set it up once. After that you only hear from it when something changes.
Add a site
Enter the domain. A free first scan shows what is visible from the outside right now.
Verify ownership
Add a DNS record or a meta tag. Full evidence and deeper checks unlock only for verified owners.
Weekly scans, quiet alerts
Every week the site is re-checked. A new exposure, an expiring certificate or a changed record triggers an alert with the fix.
Built for agencies and freelancers
Add it to your care plans. Your clients get a monthly security report with your logo on it. You get alerted before they do.
Join the agency early access- White-label monthly PDF with your brand
- One dashboard for every client site
- Fix steps written for cPanel, WordPress, Laravel, Nginx and Apache
- Alerts only when something changes, not weekly noise
- No plugin, no server access, nothing to install on client sites