What it is

A backup-looking file (for example a .zip or .sql database export) was found sitting inside the web root, downloadable by anyone who finds or guesses its URL — a single file like that can hand over the entire site and database.

How to fix it

Delete it or move it outside the web root immediately, and make sure future backups are stored somewhere that isn't directly reachable by a browser.

In depth

Your website has a backup file sitting in a folder that anyone on the internet can download if they know where to look. Backup files are complete copies of your website and database, so if someone gets one, they essentially have the keys to your entire site—they can see all your user information, passwords, content, and anything else stored there. This happened because backups were saved in the same area of your server where your website files live, instead of being stored somewhere private and inaccessible from the web. To fix this right now, your hosting provider or a technical person needs to find and delete that backup file immediately, then make sure any future backups are saved outside your web-accessible folders, ideally in a private storage area or downloaded to a secure location off your server entirely.