Publicly accessible sensitive files

Files that should not be accessible from the internet, but are by mistake: .env with passwords and keys, a .git folder with source code, a backup of wp-config.php with the database password, or the debug.log debugging log. Attackers search websites for them en masse. Such a file must be removed immediately, and all passwords stored in it must be changed.