What it is

An editor backup copy of wp-config.php (wp-config.php~, left behind by some text editors) is publicly downloadable, exposing the same database credentials as the real file.

How to fix it

Delete this backup file from the server immediately (or move it outside the web root) — the WordPress Plugin's Security tab can block access to files like this automatically.

In depth

Your website has a backup copy of a critical file called wp-config.php~ sitting in a publicly accessible location, which means anyone on the internet can download it. This file contains sensitive information like your database password and secret security keys that WordPress uses to function, so exposing it is like leaving your house keys on the front porch. The backup was likely created accidentally by a text editor when someone edited the main configuration file and then forgot to clean up. To fix this, your hosting provider's file manager or your web developer needs to simply delete the wp-config.php~ file from your server, or move it to a location that isn't accessible through the web. This is a quick fix that takes just a minute or two, and you should ask whoever manages your WordPress site to check for and remove similar backup files (ones ending in ~, .bak, or .old) while they're at it.