The answer lies in and server configuration. When a developer sets up a new application—say, a WordPress admin panel, a MongoDB web interface (phpMoAdmin), or a custom CRM—the server creates a login page. By default, unless told otherwise, web servers do not block search engines.
Ethical security researchers perform these searches to alert companies of their exposure. They document the finding, immediately close the browser, and send a responsible disclosure notice. Malicious actors, conversely, attempt to log in immediately. Intitle Username Password
intitle:"username" "password" filetype:xls The answer lies in and server configuration