A database backup is publicly accessible

What Wordfence found

Wordfence found a file that looks like a database export in a web-reachable location and confirmed it can be downloaded.

Why it matters

A database dump contains every user record, every password hash, and everything ever written to the site. It is the whole site in one file, and it is being served to anyone who asks. Backup plugins that write into the web root are the usual cause.

How to fix it

1. 1Delete the file now, before investigating anything else.
2. 2Assume it was downloaded. Force a password reset for all users and regenerate salts.
3. 3Reconfigure the backup plugin to write outside the web root, or to remote storage.
4. 4If the site holds personal data, the exposure may be reportable — that call belongs to the site owner.
5. 5Check for older dumps alongside it; backup tools rarely leave just one.

Findings that often appear with this one

• wp-config.php is readable over the web Public files
• A user has an easily guessed password Login

How WPSecureOps treats it

The connector reports this as dbBackup. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.