shared hosting
4 articles with this tag
Your Web Host Was Breached — What Can You Actually Do?
A provider-side compromise cannot be blocked by customer settings, so the defense shifts from prevention to blast-radius reduction. The second disclosure widened the scope to member contact and contract records, so it is no longer only a rental-server story. This site's view: treat everything on shared hosting as readable, and push secrets, credentials and backups outside the provider. For the August 2026 Sakura Internet disclosure, the critical skill is reading confirmed facts separately from the parts still under investigation.
Did you leave a secret file in a public directory? Audit your webroot
Anything in your webroot is fetchable by URL by anyone. A leftover token/credential JSON, .env, or backup means instant exposure — and if it came from a shared template, every site has the same hole. Fix: put only publicly-shareable things in the public dir, keep secrets outside the webroot at perms 600, and once you find one, audit every site and host.
Keeping .env off the public web on shared hosting
The real fix: app body outside the docroot, only public/ exposed. Stop the bleeding with .htaccess, make it permanent by restructuring, then self-check. This site's view: this isn't one person's slip but an industry-standardized bad pattern — fix it with process, not vigilance. bootstrap-redirect beats symlink.
Laravel apps' .env was readable by the whole world — the most common shared-hosting mistake
The cause: the whole app sat under the web root; only public/ should be visible. Fix in three steps — .htaccess first aid, rotate keys, restructure — then prevent it with process.