Requests about 30 paths that should never answer on a public site and confirms every hit against a content signature, so a soft 404 that returns the home page is never reported as a leak.
Read the story behind this tool: Why Exposed Files Probe exists.
Related: API Secret Leakage Audit / WordPress Security Audit / Security Headers Audit
The probe runs against the site root of whatever URL you enter. It sends about 30 GET requests (36 when WordPress is detected) and reads each body, so a 200 only counts when the content matches what the file is supposed to contain. An archive probe that times out gets one HEAD request, because a real backup can be too large to pull through the proxy. Run it only on sites you own or are authorized to test.