Backup folder visible

Why it matters

Such a folder can hold a complete copy of your site including the database, with customer data and passwords. The file name often contains a random code, so an attacker has to guess, but that is not a safe place to keep it.

How Snaglist checks it

On WordPress sites Snaglist asks for the known folders of the common backup plugins, after first asking for a folder that certainly does not exist. A site that answers everything is not reported. It does not look inside the files.

Common causes

• A backup plugin with default settings
• A migration that left its files behind

How to fix it

1. Check the folder through your hosting panel.
2. Remove old backups.
3. Set the plugin to store backups outside the web folder.
4. Block the folder in .htaccess.

How it shows in the report

In the report for your client this appears under the heading "Backup folders reachable from outside". When everything is in order, the report says: "No backup folders reachable from outside".