Add .htaccess to /wp-content/backups

Hi Internus,

We did previously do this but there was no reliable way to download the backup files without logging into FTP and downloading them that way. So instead the directory should have .htaccess inside it that denies Options -Indexes that stops people browsing the files, and the files now have a random filename that cannot be predicted, preventing any form of direct access.

We could add an option to disable downloading through the plugin so those that wish can lock it down completely. Or password protection would be a better option than all out restriction, so you can provide the password when downloading. However, the latter is something not easy to implement in a cross-platform reliable way.

Jason.

Hi Jason.

Thank you for your comprehensive answer. I asked for this for one simple reason:

I am .NET developer and if I want to have the data available via FTP and at the same time I want them to prevent access, I solve it using a generic handler (for PHP equivalent – https://stackoverflow.com/questions/364946/how-to-make-pdf-file-downloadable-in-html-link).

I provide data to the end user (eg. from the internal disk array) using a data stream.

Please understand it as a thing that occurred to me. Your plugin is of course completely functional and for user it is great help ??

Good luck in the further development and I wish you no errors or application exceptions!

Hi Internus,

We did previously stream the data through PHP. However, for larger backup files it would reach the 30 second PHP time limit (which on some servers is fixed) and result in a partially downloaded file.

The major issue is most browsers actually report this as a successful download… So unless you double check the EXACT downloaded bytes there is no way to know it didn’t download it all. And of course it’s not something users expect.

So we had to stop using the data stream method because it was far too unreliable, and use this new method instead. An incompletely/corrupt downloaded backup can be quite a big issue.

Regards,

Jason

Hi Jason,

Thank you for your answer. I understand it cannot satisfy to all users (and their webhosters).

Regards,
Lukas