Sensitive Files
Drupal Backup File Exposure Check
Drupal backup files (backup.sql, backup.zip) can expose your entire site. Detect their presence and learn how to secure them.
What this test checks
This test checks whether Drupal backup files (backup.sql, backup.zip, backup.tar, backup.gz, etc.) are publicly accessible. These files contain your entire database, files, and sometimes credentials. Their exposure allows an attacker to steal all your data, copy your site, or destroy it.
Our recommendation
Place all backup files outside your site's public directory. Use backup modules (e.g., Backup and Migrate) that store files in a non‑web‑accessible folder. Delete obsolete backups. Use secure external backup services.
Security tests
Read more
Form Security