Laravel Backup Files in Public Directory: How to Find and Remove Exposed Archives and Dumps

The Problem

How to Fix

1. 1

   Find backup files in public directories

   Search for common backup file patterns:

   find public/ -name '*.sql' -o -name '*.sql.gz' -o -name '*.zip' -o -name '*.tar.gz' -o -name '*.bak' -o -name '*.backup' -o -name '*.old' -o -name '*.dump' -o -name '*.db'

   Also check for copies of sensitive files:

   find public/ -name '.env*' -o -name '*.php.bak' -o -name 'composer.json' -o -name 'composer.lock'

   Check the project root too — some web server configs serve from the wrong directory.

2. 2

   Remove or move backup files

   Delete backup files from public directories:

   rm public/backup.sql.gz
   rm public/site-backup.zip

   For backups you need to keep, store them outside the web root:

   # Move to storage (not publicly accessible)
   mv public/backup.sql.gz storage/app/backups/

   # Or use Laravel's backup package
   composer require spatie/laravel-backup
   php artisan backup:run
   # Stores backups in storage/app/backups/ by default

3. 3

   Block backup file extensions in your web server

   Add a rule to block common backup extensions:

   Nginx: location ~* \.(sql|sql\.gz|bak|backup|old|dump|db|tar\.gz)$ { deny all; return 404; }

   Apache (.htaccess):
   <FilesMatch "\.(sql|bak|backup|old|dump|db|tar\.gz)$">
       Order allow,deny
       Deny from all
   </FilesMatch>

How to Verify

curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/backup.sql
curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/db.sql.gz
curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/site.zip

Prevention

Frequently Asked Questions