Backup files (.bak, .old, .zip, .sql, ~ files left by editors) are sometimes accidentally left in a site's public folder during development or migration — these often contain full database dumps or complete site copies that bypass every access control your live site has.
Backup files (wp-config.bak, database.sql, site.zip) often contain plaintext credentials. They're frequently left in web roots during migrations and never removed.
Automated, offsite backups with genuinely tested restoration address one of the most fundamental business-continuity risks any website faces — data loss from server failure, successful attack, accidental deletion, or any number of other real failure scenarios can be catastrophic without genuine, working backup infrastructure to recover from.
The offsite requirement specifically addresses a real, common failure mode in backup strategy — backups stored on the same server or infrastructure as the original data provide no genuine protection against scenarios that affect that entire infrastructure, whether a hardware failure, a successful attack that compromises the whole server, or any other event affecting the primary system and its local backups simultaneously.
The testing requirement deserves particular emphasis, since this is where many backup strategies that appear adequate on paper actually fail in a genuine crisis — a backup system that's never been tested for actual restoration can harbor configuration errors, corruption, or incompleteness that only becomes apparent during a genuine, high-stakes recovery attempt, precisely the worst possible moment to discover the backup doesn't actually work as intended.
Automation addresses a genuine human-reliability gap in backup practices — manual, remembered backup processes are vulnerable to simply being forgotten or delayed during busy periods, while automated backups running on a genuine, consistent schedule remove this human-reliability dependency, ensuring backups actually happen consistently regardless of what else is competing for attention.
No backup-pattern files are accessible via direct URL request, and a server-level rule blocks the common extensions as a backstop.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →