Key Takeaways

• The Core Risk: The wp-config.php.bak file is a manual backup of your WordPress configuration that often contains plain-text database credentials.
• The Vulnerability: Unlike wp-config.php, which is executed by the server as PHP, backup files with extensions like .bak, .old, or .save are often served as plain text, exposing sensitive data to anyone with the URL.
• The Threat Actor Method: Attackers use "Google Dorking" and automated vulnerability scanners to locate these specific filenames across millions of websites.
• Immediate Action: Delete all .bak versions of configuration files from your production environment immediately.

Understanding the Anatomy of wp-config.php.bak

In the WordPress ecosystem, wp-config.php is the most sensitive file in the directory. It acts as the bridge between the WordPress application and your MySQL/MariaDB database, housing the database name, username, password, host, and unique authentication salts.

The file extension .bak is a common convention used by developers and system administrators to create a "backup" before making manual edits to the configuration. While this is a standard safety procedure in local development, it becomes a catastrophic security oversight when deployed on a live production server.

Why the Extension Matters

The danger lies in how web servers (Apache, Nginx) interpret file extensions. When a server encounters a .php file, it processes the code internally and only sends the resulting HTML to the user. However, when a server encounters a .bak file, it does not recognize it as a script. Instead, it assumes it is a static text file and delivers the raw, unencrypted source code directly to the browser.

Comparative Risk Analysis: Standard vs. Backup Configuration

The following table illustrates the technical differences between the operational configuration file and its common backup variant.

The Attack Vector: How Exploitation Occurs

Cybercriminals do not manually guess your filenames. They utilize automated methodologies to find "low-hanging fruit."

1. Google Dorking

Attackers use advanced search operators to find specific file patterns indexed by search engines. A simple query like filetype:bak "DB_PASSWORD" can return thousands of