Find private WordPress files that visitors can download

Why a WordPress backup can become a security risk

A backup is useful only if access is controlled. A copied configuration file, database export or debug log left in a public folder may disclose credentials, internal paths or other sensitive information. The live website can keep working while the copy is exposed.

Do not assume that a file is private because it has an unfamiliar extension or a hard-to-guess name. Keep website backups in an appropriate protected location and verify access rules with the host when you change the storage setup.

Understand what the Sentinel check covers

Sentinel flags selected public file exposures for review. A finding identifies a risk to investigate, helping you arrange the appropriate access restriction or removal.

It is not a penetration test, a crawl of every server directory or a guarantee that no sensitive file remains. Coverage depends on the available checks and whether they completed successfully. A blocked or incomplete check should be reviewed as a visibility limit.

Respond when a sensitive file was publicly accessible

Preserve the necessary evidence without sharing sensitive contents. Remove the public copy or restrict access, then assess what the file contained and whether credentials should be rotated. A database export can require a different response from a harmless log entry.

Ask the host or developer to verify the rule that prevents another exposure. Use hardening controls and file integrity findings alongside the public-file review. If you see evidence of a wider compromise, follow the hacked WordPress response guide.