Backup Files Exposed
What This Means
This finding indicates that backup files are publicly accessible on your site.
These files may contain full or partial copies of your website or database.
Why It Matters
Backup files often include:
- complete site data
- database exports
- configuration information
- user data
If exposed, attackers may:
- download your entire site
- extract sensitive information
- identify vulnerabilities
- gain access to your database structure
How Steel Security Detects This
Steel Security scans for common backup file patterns and locations.
This may include files with extensions such as:
.zip.tar.gz.sql.bak
If these files are accessible via a browser, they are flagged.
How to Fix It
To resolve this issue:
- remove unnecessary backup files from public directories
- move backups to secure, non-public locations
- restrict access using server-level rules
You may also use Steel Security hardening controls related to file protection.
What to Expect After Fixing
After applying protections:
- backup files will no longer be accessible via browser
- sensitive data will not be exposed publicly
- your site structure will remain secure
How to Verify
To verify the fix:
- attempt to access the backup file via its URL
- confirm that access is denied or the file no longer exists
Common Causes
- backups stored in the web root or uploads directory
- automated backup plugins saving files in public locations
- leftover files from manual backups
Best Practices
- store backups outside the public web directory
- use secure storage locations (offsite or restricted access)
- regularly clean up old backups
- restrict access to any backup-related directories