How to check your website for exposed secrets, free and without signing up

You do not need a product to answer the question "is my website leaking something". Most of it you can check yourself, in a browser, in about ten minutes. Here is exactly how, in the order that finds the worst things first.

1. Look for credentials in your own JavaScript

Open your site, then open developer tools — F12, or right-click and choose Inspect. Go to the Network tab and reload the page. Filter to JS.

Now use the search across all files. In Chrome that is the magnifying glass in the Sources panel, or Ctrl+Shift+F. Search for each of these, one at a time:

• sk_live and sk_test — Stripe secret keys
• service_role — a Supabase key that bypasses row-level security
• AKIA — an AWS access key
• AIza — a Google API key
• -----BEGIN — a private key of any kind
• password and secret — crude, but it finds things

Anything that returns a hit inside your own bundle is public. Not "could become public" — public, right now, to anyone who does what you just did.

2. Ask for files that should not be there

Type each of these after your domain, straight into the address bar:

• /.env
• /.env.production
• /.env.local
• /config.json
• /backup.sql
• /.git/config

You want a 404 for every one. If any of them returns a page of text, everything in that file is public and should be treated as compromised.

3. Check what Google has been told

Visit /robots.txt and read it. A Disallow: line covering a section you want found will keep it out of search entirely.

Then view the page source of your most important pages — Ctrl+U — and search for noindex. On a page you want customers to find, that tag is why they cannot.

Finally, search Google for site:yourdomain.com. The number of results should roughly match the number of pages you expect. Far fewer usually means an indexing problem; far more usually means duplicate URLs competing with each other.

4. Check your certificate has not quietly expired

Click the padlock in the address bar and look at the certificate's expiry date. If it is within a month and you do not know for certain that renewal is automatic, find out — an expired certificate replaces your website with a full-page browser warning, and most visitors leave rather than click through it.

5. Check your headers

The quickest version: open developer tools, Network tab, reload, click the first request, and read the Response Headers.

You are looking for whether these exist at all:

• strict-transport-security
• content-security-policy
• x-frame-options or a frame-ancestors directive
• x-content-type-options

Most generated and template-built sites have none of them. Nothing breaks without them, which is exactly why they are missing.

What to do if you find something

If it is a credential, rotate it before anything else. Go to whichever provider issued it and revoke the old one. Moving a key out of your code does nothing while the old value still works, and this is the step people skip.

If it is a file that should not be served, delete it from the deployed directory — then still rotate whatever was inside it. It has been public; you cannot know whether anyone took it.

If it is a noindex on a page you want found, remove the tag and then request indexing in Google Search Console rather than waiting for a recrawl.

If it is a missing header, add it. That one is not urgent, and it is not something to panic about at eleven at night.

Why we built a tool that does this

Everything above is genuinely doable by hand, and if you have done it, you have covered most of the serious ground. The reasons to automate it are narrow and worth being honest about: the manual version checks one page rather than all of them, it finds only the patterns you thought to search for, and nobody does it a second time three months later when a new deploy has quietly reintroduced something.

If you would rather not do it by hand, ours is free for the first run and needs no account. But do it by hand rather than not at all — the checks above are the same ones we run, and the point is that somebody looks.