Is it secure to leave a database dump in the site folder?

  • Resolved felixtheratruns

    (@felixtheratruns)


    8 years, 9 months ago

    Lets say the database dump has stuff in it you don’t want people who aren’t users on the server (visitors to site, hackers, etc…) to see. (I understand it shouldn’t matter in most cases because passwords and other sensitive stuff are stored as a hash, am I right about this?) Is it ok to leave it with whatever permissions in the site folder e.g. in the same folder as wp-config.php or would you have to make sure permissions were set a certain way? or should you just not leave it in the site folder at all? Thanks.

Viewing 7 replies - 1 through 7 (of 7 total)

  • Personally, I would never leave a data dump on my server especially in a publicly available directory.

    jack randall

    (@theotherlebowski)

    not a good idea felix, your DB dump contains all sorts of goodies that hackers might want to get their hands on. create the back up, store it offline somewhere and only use it when you need it. (make regular backups too!)

    Thread Starter felixtheratruns

    (@felixtheratruns)

    Well I want to store a backup of the database in the same git repo as the wordpress site. (I haven’t found a way to keep track of the database synchronized with updates to the site’s code except by doing this) So what would be the most secure way to do this? If I put the dump in a subfolder with permissions 700 I can’t get to it through the browser, same goes if I set the permissions on the file to 700. (600 works too and my understanding is that they would have to hack the server to access the file)

    jack randall

    (@theotherlebowski)

    leaving it anywhere in plain sight is taking an unholy risk. you shouldn’t put your faith in permissions and other web tricks to stop a determined hacker, they’ll only deter the casual nosey parker. if you leave things like DB usernames and passwords laying about in the open then someone can access the server you’re on and compromise other sites.

    the only way to stop a bear from ruining your picnic is to keep your food sealed.

    Thread Starter felixtheratruns

    (@felixtheratruns)

    ok ok ok! I’m scared now you can all lay off ?? ?? also this is a really good thing to read: https://blog.sucuri.net/2015/06/websites-hacked-via-website-backups.html

    Thanks guys, I appreciate the well deserved warning.

    Is the git repo a dotted folder, as in .git  ? If so, that’s a folder invisble to browsers and search engines. Still not the greatest idea, but better than a “visible” folder.

    Thread Starter felixtheratruns

    (@felixtheratruns)

    No it’s not a .git. Good to know, thanks.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Is it secure to leave a database dump in the site folder?’ is closed to new replies.