Web-accessible storage.
THE RULE
Anything inside public_html can be downloaded by anyone who knows or guesses the address.
Nothing protects it unless you specifically protect it.
WHAT THIS MEANS PRACTICALLY
A backup archive left there can be downloaded by anyone A database export there exposes your entire database A spreadsheet of customers there is a data breach
WHY PEOPLE DO IT
Convenience. Creating a backup through cPanel and leaving it in place.
THE GUESSING POINT
Attackers scan for common filenames: backup.zip, site.sql, database.sql, wp-config.bak.
An obscure name is not protection. Automated scanning finds them.
WHAT TO DO INSTEAD
Download backups and delete them from the server Store anything sensitive above public_html Use Directory Privacy for anything that must be there but restricted
WHAT TO CHECK NOW
Look in public_html for any archive, export or document that should not be public.
Most accounts have something.
