Can anyone download my website backup files?
Updated 2026-10-17
Short answer: yes, if they sit in a folder your website serves. A file like backup.zip or wp-config.php.bak left on the server can be downloaded by anyone who guesses its name, and automated scanners guess common names all day. These files often hold database passwords and keys.
How to check it yourself
- Visit the common names on your own domain:
/backup.zip,/wp-config.php.bak,/.aws/credentials,/phpinfo.php. - Each one should return 404 or 403, never a download.
- Move backups out of the website's public folder, or delete them from the server.
- If any file was downloadable, change every password and key it contained.
What Preventionlabs shows
On domains you've proven are yours, every report checks from the outside for files that should never be public: .env files, git repositories, config backups, server status pages and similar, and says plainly when one couldn't be read. For example, from a real report: "/wp-config.php.bak couldn't be read (HTTP 403)", and on another site nine such addresses were checked, including /backup.zip, /phpinfo.php and /.aws/credentials.
It checks the common names scanners try. A backup under an unusual name won't be found by guessing, so it's still worth looking in your public folder yourself.
Price
First report free, no card needed. Then A$50 a month, up to 10 domains.