Unexpected file exposure in _site directory via Jekyll exclude configuration

Question

Jekyll utilizes the exclude setting in _config.yml to prevent specific files, directories, or glob patterns from being copied into the final _site output folder. While files starting with an underscore are excluded by default, other sensitive environment files or custom data directories must be explicitly listed to avoid public exposure.

A challenge arises when managing complex directory structures where certain files must remain in the source repository for build purposes but must never be rendered in the static output. There is uncertainty regarding how Jekyll handles the intersection of default exclusions and custom glob patterns when nested directories are involved.

Does the exclude list override default Jekyll behavior for files that would otherwise be included?
  How does Jekyll resolve conflicts when a file matches both an inclusion pattern and an exclusion glob?

Tasadduq Burney · Answer

Answer to the Core Questions
1. Does the exclude list override default Jekyll behavior for files that would otherwise be included?
   Yes. The exclude key is consulted after Jekyll’s built‑in exclusions (files or directories that start with an underscore, _config.yml, etc.). If a file matches an exclude pattern, it will not be copied unless an include pattern explicitly re‑includes it.
2. How does Jekyll resolve conflicts when a file matches both an inclusion pattern and an exclusion glob?
   Inclusion wins. The build process evaluates include patterns first; if a path matches an include entry, it is copied regardless of any exclude match. If it matches only exclude, it is omitted.

Why the File Still Appears

The file might live outside the source directory (e.g., a sibling folder). Jekyll copies everything under the source root; files outside that root are ignored by exclude.
  A plugin (e.g., jekyll‑assets, jekyll‑copy‑file) can override the exclusion logic and copy files unconditionally.
  An indentation or spelling error in _config.yml can make the exclude key ineffective.
  Generated files created after the first build may bypass the exclusion list on subsequent builds.

Minimal Isolation Steps

Verify the file’s location. Run ls -R from the site root and confirm the file is inside the source directory.
  Check the build log. Execute jekyll build --verbose and look for a line like Copying: path/to/file. If it appears, the file was not excluded.
  Validate the exclude pattern. Use jekyll config or a YAML linter to ensure the key is spelled correctly and properly indented.
  Test with plugins disabled. Temporarily comment out any custom plugins: entries in _config.yml, rebuild, and see if the file disappears.
  Experiment with a minimal site. Create a new Jekyll project, copy only the problematic file into the source, add the same exclude entry, and run jekyll build. If the file still appears, the pattern syntax is wrong.

One Diagnostic Question That Could Change the Recommendation
Is the file being generated by a plugin or by a post‑build script after the initial Jekyll run?
If the answer is yes, the recommendation shifts from tweaking exclude to adjusting the plugin configuration or moving the file to a location that is explicitly excluded.

Practical Verification
After applying the above steps, run jekyll build again. The file should no longer appear in _site and the verbose log should omit any Copying line for that path.

Unexpected file exposure in _site directory via Jekyll exclude configuration

1 answer

0 question comments

Answer to the Core Questions

Why the File Still Appears

Minimal Isolation Steps

One Diagnostic Question That Could Change the Recommendation

Practical Verification

Your perspective belongs here.