Remove version-disclosing files (readme.html, CHANGELOG.txt)

Version-disclosing files like readme.html and CHANGELOG.txt, often included by default with common content management systems and software packages, reveal your exact software version to anyone who checks these standard, predictable file locations — this represents the same reconnaissance-enabling risk discussed regarding server version headers, applied to a different, file-based disclosure point.

The genuine risk this creates mirrors the broader version-disclosure principle discussed elsewhere — knowing your exact software version allows an attacker to check that specific version against known, documented vulnerabilities, potentially identifying an exploitable weakness without any active probing beyond simply requesting these standard, predictable file paths.

These files are commonly included by default in software distribution packages and frequently never removed during deployment, meaning many sites unknowingly expose this information not through any deliberate choice but simply through never having addressed default files that ship with their underlying software.

Removing or restricting access to these specific files represents genuinely low-effort remediation — these files typically serve no functional purpose once your site is actually deployed and running, making their removal a safe, straightforward action that closes off this particular reconnaissance opportunity with essentially no functional tradeoff.