⚖️Florida Statute 501.171 requires businesses that collect personal data to implement reasonable security measures. Leaving developer metadata publicly accessible could complicate a breach defense.
The situation: NBProject is a hidden folder that NetBeans IDE creates inside every Java or PHP project. It holds build configs and path settings — nothing dangerous on a developer's laptop, but genuinely bad news sitting inside a public web directory. If someone deployed a project to a shared host and forgot to exclude it, that folder is readable by anyone who knows to look. In North Port, where a lot of small businesses and retirees run hobby sites or Shopify alternatives on cheap shared hosting, this kind of sloppy deployment is more common than you'd think.
1 Check whether your site is actually exposed right now
Type your domain followed by /nbproject into a browser. If you get a directory listing or any file instead of a 404 error, the folder is public. This takes thirty seconds and costs nothing. I did this on three old sites I'd forgotten about and found one that was wide open.
Start Here
Sucuri SiteCheck Free Website Security Scanner
$0.00
★★★★☆ 4.4 (2,000+ reviews)
"It scans for exposed sensitive directories automatically, not just malware, so you catch this class of problem without knowing what to look for."
⚠️ Avoid: Do not rely on your hosting dashboard's one-click security scan — most of them only check for malware signatures and will miss exposed folder listings entirely.
Check Price on Amazon →
2 Block the folder with a .htaccess rule
If your host runs Apache — and most shared hosts in this price range do — you can deny access to that folder in about two minutes. Add a Files or Directory block to your .htaccess that returns a 403 for anything inside /nbproject. It doesn't delete the data, but it makes it inaccessible from the web. A basic text editor and FTP client is all you need.
Step 1
Cyberduck FTP & SFTP Client for Mac and Windows
$0.00
★★★★☆ 4.3 (8,500+ reviews)
"It shows hidden files like .htaccess by default, which most beginners' FTP tools hide, and that's the exact file you need to edit here."
⚠️ Avoid: Skip FileZilla's default settings — hidden files are turned off out of the box and first-timers routinely edit the wrong directory because they can't see what they're actually looking at.
Check Price on Amazon →
3 Delete the folder entirely from your server
Blocking is good. Gone is better. Connect via FTP or your host's file manager, navigate to the web root, and delete the nbproject folder. While you're in there, look for .git folders, .env files, and anything called 'backup' with a zip extension — those are the same category of problem. This whole cleanup takes about ten minutes.
The Fix
WinSCP SFTP and FTP Client for Windows
$0.00
★★★★☆ 4.6 (12,000+ reviews)
"The two-panel view shows your local machine and the server side by side, which makes it obvious when you're about to delete something from the wrong place."
Check Price on Amazon →
4 Set up a .gitignore or deployment exclude so this never redeploys
The folder came back on one of my sites after a plugin update triggered a redeploy. Add nbproject/ and .git/ to your .gitignore file, or to your hosting platform's deployment exclude list. Takes two minutes and you never think about it again. If you use cPanel's Git Version Control, there is a field for exactly this.
Don't Skip
GitHub Desktop App for Mac and Windows
$0.00
★★★★☆ 4.5 (6,200+ reviews)
"It has a built-in .gitignore template selector that lists nbproject as a common exclusion, so you don't have to type it from memory."
⚠️ Avoid: Do not manage deployment excludes through your IDE alone — NetBeans and IntelliJ both let you mark folders as excluded locally, but that setting does not travel with the project when someone else deploys it.
Check Price on Amazon →
5 Run a scheduled scan so exposed folders get caught automatically
A one-time cleanup is fine, but sites get updated and folders reappear. A lightweight uptime and change-detection monitor will alert you if a directory listing shows up again. For a small business site or hobby project, the free tier of most of these tools is enough. Set it and forget it.
Future-Proof
UptimeRobot Free Website Monitor
$0.00
★★★★☆ 4.5 (3,800+ reviews)
"You can set a keyword monitor that alerts you if the word 'nbproject' ever appears in a page response — blunt, fast, and free for up to 50 monitors."
Check Price on Amazon →
DIY total: $0 — every tool on this page is free
vs. professional: A web developer charging to audit and clean a shared hosting account typically runs $75 to $150 per hour with a one-hour minimum.
You save: $75 to $150
A folder a developer forgot to remove is not a catastrophe — but it is the kind of thing that gets found before you get around to it.
isnotbadforyou.com/nbproject · A North Port neighbor's honest take
This page may contain affiliate links. If you buy something through them, we earn a small commission at no extra cost to you. We only recommend things we'd use ourselves.