What it is

A backup copy of wp-config.php (wp-config.php.bak) is publicly downloadable. This file normally contains your database name, username and password in plain text — anyone who finds it gets direct database access.

How to fix it

Delete this backup file from the server immediately (or move it outside the web root) — the WordPress Plugin's Security tab can block access to files like this automatically.

In depth

Someone can download a backup copy of your WordPress configuration file that was accidentally left on your server, and this file contains your database password and other sensitive login information in plain text. If a bad actor gets this file, they can log directly into your database and steal or modify everything on your site, including customer data, posts, and settings. This happened because when someone updated or backed up your site, they created a copy of this configuration file but didn't delete it afterward. The fix is straightforward: you need to ask your hosting provider or site administrator to delete the file called "wp-config.php.bak" from your server, or if you have file access yourself, use your hosting control panel to find and delete it. After deletion, you should change your database password and consider enabling a security plugin that can automatically prevent these types of backup files from being left behind in the future.