From across Automattic.

WordPress Database Backup Files

<!– wp:heading {"level":3} –> <h3 id="what-are-database-backup-files">What are database backup files?</h3> <!– /wp:heading –> <!– wp:paragraph –> <p>There are many tools and WordPress plugins that allow you to create a backup of your database and export it to a file. Sometimes these backup files can end up in publicly accessible locations and with predictable names, such as <code>backup.sql</code>, <code>database.sql</code>, <code>example.com.sql</code>, and so on.</p> <!– /wp:paragraph –> <!– wp:heading {"level":3} –> <h3 id="what-are-the-security-risks-with-wordpress-database-backup-file-exports">What are the security risks with WordPress database backup file exports?</h3> <!– /wp:heading –> <!– wp:paragraph –> <p>As mentioned above, if these database backup file exports are left in a publicly accessible directory on the webserver with a predictable file name, then they could easily be accessed by an attacker. All the attacker has to do is guess the correct backup file name and its directory to download the file.</p> <!– /wp:paragraph –>