Question
Unexpected file exposure in _site directory via Jekyll exclude configuration
Rahul Maple
0 reputation · 03 Aug 2020, 11:50 UTC
132.2K views
Loading…
0 reputation · 03 Aug 2020, 11:50 UTC
Jekyll utilizes the exclude setting in _config.yml to prevent specific files, directories, or glob patterns from being copied into the final _site output folder. While files starting with an underscore are excluded by default, other sensitive environment files or custom data directories must be explicitly listed to avoid public exposure.
A challenge arises when managing complex directory structures where certain files must remain in the source repository for build purposes but must never be rendered in the static output. There is uncertainty regarding how Jekyll handles the intersection of default exclusions and custom glob patterns when nested directories are involved.
exclude list override default Jekyll behavior for files that would otherwise be included?30275 reputation · 03 Aug 2020, 20:28 UTC
1. Does the exclude list override default Jekyll behavior for files that would otherwise be included?
Yes. The exclude key is consulted after Jekyll’s built‑in exclusions (files or directories that start with an underscore, _config.yml, etc.). If a file matches an exclude pattern, it will not be copied unless an include pattern explicitly re‑includes it.
2. How does Jekyll resolve conflicts when a file matches both an inclusion pattern and an exclusion glob?
Inclusion wins. The build process evaluates include patterns first; if a path matches an include entry, it is copied regardless of any exclude match. If it matches only exclude, it is omitted.
jekyllexclude.jekyll‑assets, jekyll‑copy‑file) can override the exclusion logic and copy files unconditionally._config.yml can make the exclude key ineffective.ls -R from the site root and confirm the file is inside the source directory.jekyll build --verbose and look for a line like Copying: path/to/file. If it appears, the file was not excluded.exclude pattern. Use jekyll config or a YAML linter to ensure the key is spelled correctly and properly indented.plugins: entries in _config.yml, rebuild, and see if the file disappears.exclude entry, and run jekyll build. If the file still appears, the pattern syntax is wrong.Is the file being generated by a plugin or by a post‑build script after the initial Jekyll run?
If the answer is yes, the recommendation shifts from tweaking exclude to adjusting the plugin configuration or moving the file to a location that is explicitly excluded.
After applying the above steps, run jekyll build again. The file should no longer appear in _site and the verbose log should omit any Copying line for that path.
Use comments to ask for clarification. Post a solution as an answer.
30,275 reputation · 03 Aug 2020, 17:32 UTC
One detail worth adding to the pattern discussion: how you write the glob changes what it matches. A pattern like secret.txt matches that filename anywhere in the tree, while /data/secret.txt (leading slash) anchors the match to the site root. For nested structures, data/**/secret.txt is the reliable way to catch every depth.
Also note that excluding a directory prunes the whole subtree — Jekyll won't descend into it, so you can't re-include individual files inside an excluded directory.
On the include/exclude precedence question, I'd treat it as version-sensitive (3.x vs 4.x behavior may differ) and verify empirically rather than trusting memory:
jekyll build --verbose
find _site -name "secret.txt"
If the file still lands in _site, check for plugins that copy files outside the normal pipeline before assuming the config is wrong.