Files left sitting in your WordPress directory can be dangerous—here’s why.

Here, we’ll explain the security risks posed by various files left sitting in your WordPress directory.

Dangerous Files Left in the WordPress Directory

When hackers attempt to compromise a site, they may try to access various files stored in the WordPress directory by randomly entering their URLs in an attempt to use them as a foothold for the attack.
For this reason, we strongly recommend that you do not leave the files described below on your server.
*Blocking access via .htaccess settings is also an effective security measure.

1. Remnants of wp-config.php

wp-config.php is WordPress’s configuration file that contains extremely important settings, such as database connection information.
For this reason, hackers may attempt to obtain remnants of this file in order to add unauthorized administrators or alter content. (While direct access to `wp-config.php` displays nothing, the contents of these remnants may be viewable.)

Examples of URLs that may be accessed:
/wp-config.php.bak
/wp-config.php.old
/wp-config.php~
/wp-config.php.save
/wp-config.php.orig
/wp-config.php.swp

Directories:
/.bak
/.old
/.orig
/.save, etc.

We recommend that you delete all backup files of `wp-config.php` and similar files from the server.

2. Git Repository Information for Development

Please check to ensure that no development folders—such as .git/, .svn/, or .env—have been left on the server.

Hackers could potentially use these files to reconstruct the entire source code, including WordPress configuration files.

3. Database Connection Files

To easily connect to the database, hackers may have already stolen your database connection information or may search the server for database connection programs to launch brute-force attacks.

URLs such as the following are common targets for attacks:
/phpmyadmi
/phpMyadmin (with some letters capitalized)
/phpmyadmin(combination of numbers)
/phppma
/myadmin
/PMA
/pma
/phpMyAdmin-version-all-languages
/adminer.php
/adminer-version.php
/adminer-version-mysql.php
/adminer
etc.

*Note: The `setup.php` file in PHPMyAdmin (used to configure database connections) may also be targeted.

We strongly recommend that you either avoid installing database connection software on the server altogether, or install it in a folder with a random string name and apply Basic Authentication—taking extreme caution during installation.

4. Database Dump Files

If database dump files (backup files containing content, administrator IDs, and passwords) are left on the server, they may be compromised.

/db_backup.site-domain.sql.gz
/db_backup.sql.gz
/dump.sql
/site-domain.sql
/backup.sql
/db.sql
/database.sql
/sql.sql
etc.

*Even if a hacker gains access to the database, they will not be able to obtain the administrator password.This is because WordPress stores passwords in an encrypted format. However, if a hacker manages to obtain not only the database but also the values for `AUTH_KEY` and `SECURE_AUTH_KEY` (which are written in `wp-config.php`), they can spoof cookies and log in to WordPress as an administrator.

I hope this information is helpful.

If your WordPress site has already been hacked and malware has been installed, we recommend running a malware scan using a plugin.
[Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal]