Regularly scan your public folders for .txt , .bak , .sql , or .old files.

Having a list of valid usernames is 50% of the work for a hacker. They no longer have to guess who the users are; they only have to guess the passwords.

Traditionally, it contains a list of every user account on a system.

In Apache, you can do this by adding Options -Indexes to your .htaccess file. In Nginx, ensure autoindex is set to off .