Backup archives can contain highly sensitive information, including website source files, configuration files, databases, email data, SSL-related data, and credentials stored by applications.
- Store backups in access-controlled locations.
- Do not place backup archives inside a publicly accessible web directory.
- Remove unneeded copies from the hosting account after verifying an off-account copy.
- Protect remote storage credentials.
- Delete old backups according to your own data-retention needs.
Treat a full account backup as sensitive account data, not as a public download.
