Hetzner Object Storage
Hetzner's 2024 Object Storage offering is S3-compatible and hosted at `<bucket>.<region>.your-objectstorage.com`. Public exposure follows the standard S3 ACL pattern.
Hetzner Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
As a newer product, Hetzner Object Storage lacks third-party hardening tooling that exists for AWS. Operators relying on copy-pasted Terraform from S3 examples often forget the `acl = "private"` default behaves differently.
Real-world impact
Public ACL enables unauthenticated LIST + GET. Hetzner's very low pricing makes it a common target for inadvertent CDN bills.
Remediation
- Set ACL to `private` at bucket creation and avoid `--acl-public` in deploy scripts.
- Enable bucket logging to detect anonymous access patterns.
URL patterns
Hetzner Object Storage buckets typically resolve under hostnames like:
example.fsn1.your-objectstorage.comexample.nbg1.your-objectstorage.com
Check a specific Hetzner Object Storage URL
Paste any Hetzner Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Hetzner Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request