What is in a database dump that matters?

Everything the site knows: every user's email and password hash, all content including unpublished drafts and private posts, form submissions, order data if the site sells anything, and every plugin's stored configuration. A downloadable .sql file is a full copy of the site's data for whoever requests it.

The file has an unguessable name. Is it really exposed?

Less than backup.sql, but directory listings, referer leaks, and backup plugins that use predictable name patterns (site name plus date) erode that protection quickly. Scanners iterate date-stamped patterns. Obscurity buys hours, not safety — the file should not be web-reachable regardless of its name.

It was exposed. What follows removing it?

Assume it was downloaded: server logs can confirm but their absence cannot deny. Force a password reset for all users (hashes crack offline at leisure), rotate anything secret stored in the database, and if the dump held personal or payment data, evaluate disclosure obligations. Then point the backup tool somewhere outside the web root so this is the last time.

Glossary · Public files

A database backup is publicly accessible

Wordfence type: dbBackup
Category: Public files
Severity: Critical

A database dump is downloadable over HTTP.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

Database backup file found publicly accessible: wp-content/backup-db/example_com.sql

What Wordfence found

Wordfence found a file that looks like a database export in a web-reachable location and confirmed it can be downloaded.

Why it matters

A database dump contains every user record, every password hash, and everything ever written to the site. It is the whole site in one file, and it is being served to anyone who asks. Backup plugins that write into the web root are the usual cause.

How to fix it

1Delete the file now, before investigating anything else.
2Assume it was downloaded. Force a password reset for all users and regenerate salts.
3Reconfigure the backup plugin to write outside the web root, or to remote storage.
4If the site holds personal data, the exposure may be reportable — that call belongs to the site owner.
5Check for older dumps alongside it; backup tools rarely leave just one.

Common questions

What is in a database dump that matters?: Everything the site knows: every user's email and password hash, all content including unpublished drafts and private posts, form submissions, order data if the site sells anything, and every plugin's stored configuration. A downloadable .sql file is a full copy of the site's data for whoever requests it.
The file has an unguessable name. Is it really exposed?: Less than backup.sql, but directory listings, referer leaks, and backup plugins that use predictable name patterns (site name plus date) erode that protection quickly. Scanners iterate date-stamped patterns. Obscurity buys hours, not safety — the file should not be web-reachable regardless of its name.
It was exposed. What follows removing it?: Assume it was downloaded: server logs can confirm but their absence cannot deny. Force a password reset for all users (hashes crack offline at leisure), rotate anything secret stored in the database, and if the dump held personal or payment data, evaluate disclosure obligations. Then point the backup tool somewhere outside the web root so this is the last time.

Findings that often appear with this one

wp-config.php is readable over the web Public files
A user has an easily guessed password Login

How WPSecureOps treats it

The connector reports this as dbBackup. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.