Exposed backup or archive files

Scan.now requests a short fixed list of well-known backup names: /backup.zip, /backup.sql, /backup.tar.gz, /site.zip, /www.zip, /db.sql, /dump.sql, /database.sql, /<hostname>.zip, /wp-config.php.bak, /wp-config.php~, /config.php.bak, /.htaccess.bak and /web.config.bak. It fetches only the first few kilobytes of any 200 response using a Range header and checks the content rather than trusting the status: ZIP files start with PK\x03\x04, gzip with 1F 8B, SQL dumps with -- MySQL dump, CREATE TABLE or INSERT INTO, and a .bak of a PHP file is confirmed by a literal <?php in the body, which means the server returned the source as text. Soft-404 HTML pages are ignored. Whole archives are never downloaded. Rated high; when the file is a configuration backup with credentials, treat it as critical.

A backup archive is the whole site in one download: application source, configuration with database credentials and API keys, and often the uploads directory with customer documents. A database dump adds the user table, with email addresses and password hashes that go straight into offline cracking, plus whatever personal data the application stores. Editor and admin backups are smaller but just as damaging: wp-config.php.bak is served as plain text because the web server only runs .php through the interpreter, and it contains the database password and the authentication salts. Attackers guess file names from the hostname and common conventions, so "nobody knows the URL" is not protection, and search engines index these files when they are linked from anywhere. The exposed files guide explains how scanners find them and the WordPress guide covers the CMS-specific cases.

Never write backups into the document root. Send them off-server (object storage with restricted access, or a backup host) and delete any that are already there:

find /var/www -type f \( -name '*.bak' -o -name '*.sql' -o -name '*.zip' -o -name '*.tar.gz' -o -name '*~' \) -print

Then deny the extensions at the server so a future mistake is not published. nginx (adjust the list if you intentionally serve archives for download):

location ~* \.(bak|old|orig|save|swp|sql|tar|gz|tgz|zip|7z|rar)$ {
    deny all;
    return 404;
}
location ~* ~$ { deny all; return 404; }

Apache 2.4:

<FilesMatch "\.(bak|old|orig|save|swp|sql|tar|gz|tgz|zip|7z|rar)$|~$">
    Require all denied
</FilesMatch>

Cloudflare WAF custom rule: (http.request.uri.path matches "\.(bak|sql|zip|tar\.gz)$"), action Block, on Pro plans or above where regex matching is available. If a configuration backup was reachable, rotate the credentials it contains and, for WordPress, regenerate the salts in wp-config.php. Check the access log for who downloaded it before you closed the door.