Scanner information

About our scanner

If you found ForgottenFilesBot in your access logs, this page explains what it was doing and how to stop it.

How to identify it

Every request sends this User-Agent:

ForgottenFilesBot/1.0 (+https://forgottenfiles.com/scanner/)

The IP addresses the scanner sends from will be listed here before scanning begins.

What it does

• It scans only domains that a user has entered, either for a one-off free scan or for ongoing monitoring by the site owner or their agency.
• It makes ordinary HTTP requests for well-known paths that should not be public, such as /.env, /.git/config, backup archives and phpinfo.php, and reads public DNS and TLS information.
• It does not log in, submit forms, guess passwords, send attack payloads or try to exploit anything it finds.
• For sites whose ownership has not been verified, it records only that a file is reachable. It does not keep or show the file's contents.
• It sends one request at a time to each site, with a pause between requests.

Opting out

Email [email protected] with the domain(s) you want excluded. They go on a do-not-scan list and are refused for all future scans.

Found something we flagged?

If a scan of your site reported an exposed file, removing it or blocking access to it in your web server configuration is the fix. Moving it out of the web root is better still. Contact us if you would like help understanding a result.