Files that should not be there.
NEVER IN PUBLIC_HTML
Backup archives Database exports Spreadsheets of customers Anything containing credentials Personal documents
WHY
Anything there is downloadable by anyone who knows or guesses the address.
Automated scanning finds common filenames.
WHAT ELSE NOT TO STORE ANYWHERE ON HOSTING
Files unrelated to your website Large media you are not serving Personal file storage
Hosting is not file storage. Using it that way consumes the space your site needs.
FOR SENSITIVE DOCUMENTS
Above public_html at minimum. Better, not on the server at all.
FOR CUSTOMER DATA
Consider what obligations apply. Under the NDPR, personal data carries responsibilities.
Visit zillionkinghost.com for further information.
WHAT TO CHECK NOW
Look through public_html for anything that should not be public.
Most accounts have something.