Guide · 2026-10-16

Is my .env file public? How to check and fix it

The 10-second check

Open https://yoursite.com/.env in a private window. You should see a 404 or your site's not-found page. If you see lines like API_KEY=..., every value in that file is public.

Why it happens

• The whole project folder was uploaded to a static host instead of just the build output.
• The .env file was placed in public/, whose contents are copied to your site as-is.
• A server is configured to serve the project root.

The fix

1. Rotate every secret in the file. Assume all of them were copied.
2. Delete the file from anything your host serves, and deploy only your build folder (often dist/, build/ or out/).
3. Add .env* to .gitignore.
4. Set secrets in your host's environment variable settings instead of a file.
5. Deploy and check /.env again.