What it is

A .env file is publicly downloadable. These files commonly hold API keys, database credentials or other secrets for the site or its plugins.

How to fix it

Delete or move this file outside the web root, and rotate any credential it contained — the WordPress Plugin's Security tab can block access to files like this automatically.

In depth

Your website has a file called .env sitting where visitors can download it directly from the internet. This file is like a master key storage box that contains sensitive passwords, API keys, and database credentials that run your site and its plugins. If someone gets this file, they could use those credentials to break into your databases, steal customer information, or take over your site completely. The fix is straightforward: your hosting provider or a technical person needs to either delete this file entirely or move it to a folder that's not accessible through the web. After moving or deleting it, you should change all the passwords and API keys that were stored in that file, since anyone could have already downloaded them. Many WordPress security plugins can also automatically prevent access to these kinds of sensitive files in the future. This is a serious issue that needs to be fixed right away, ideally within hours rather than days.