Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups".

These are saved inside the Wordpress directory. If you ask me, this seems wrong. Cant a hacker download these files or deploy a tool such as HTTrack? Then they would have enough time to get their hands on sensitive information.

As far as im aware, Wordpress doesnt store Database Backups as statements inside PHP files but .SQL, .Zip or some other format.

So my question: arent wordpress automatic backups easy targets for hackers?

  • There are quite a few backup plugins available for WP. Which one do you mean in particular ?
    – Kate
    Jun 2, 2020 at 21:46

2 Answers 2


You would presume the location where wordpress stores it's backups is either outside the locations served/accessible by the web server or that additional access controls are in place preventing access. Otherwise you're correct it is a really bad idea, that's made worse if the file names can be predicted easily.


well, I have used few of the backups and they implement few security measures. Unless you have directory listing enabled hacker will not know what is the backup filename. For example, lets talk about updraft, the plugin store backup at web_root_dir/wp-content/updraft. The backup name will be something like "backup_2018-01-24-1609_01234_52d5a23c5b23f6a-db.gz". How can anyone find this file? It is hard it, right?. It will take a long time to even crack the last part ie 52d5a23c5b23f6a.

Furthermore, some of the backup plugin use .htaccess rule to prevent any theft.

I am not saying it is entirely secure to store backups in web root directory, no it is not. But if you want the backup plugin to store backups outside the web root directory then it may require some more permission which is even worst.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .