Quick answer
Backups can contain database credentials, private customer information, email, or unpublished content. Store them in protected locations rather than leaving downloadable archives or SQL files under a website’s public document root.
Before you begin
Identify where current backups are created, who can access them, and which copies exist outside the hosting account. Review your organization’s retention and recovery requirements.
What to do
- Use a backup destination outside public web directories or an approved private backup service. Check permissions and access controls on the actual destination.
- Protect offsite credentials and encryption secrets separately from public source code. Ensure authorized recovery staff can access them when needed.
- Keep a dated inventory with source website, capture time, contents, integrity information, and restore instructions. Avoid filenames that reveal unnecessary personal details.
- Review retention and storage capacity. Preserve required recovery points while retiring redundant copies through an approved process.
- Test independent recovery periodically. A synchronized copy alone can replicate corruption or deletion and should not be mistaken for versioned backup history.
How to check the result
Confirm the backup cannot be downloaded through a public URL and that an authorized person can retrieve and verify it. Check both the local and independent copy rather than assuming a successful transfer guarantees recovery.
If you need help
If an archive was publicly exposed, remove public access through the appropriate recovery process and request an exposure assessment. Do not merely rename a sensitive file and assume earlier access or cached copies have been addressed.
Related help
- Check that a WordPress backup includes files and database
- Test a website restore without replacing the live site
- Keep credentials and private files out of your public website
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
