It's all too easy to get the configuration of a website wrong and leave the door open for anyone to see private files