A backup archive contains the entire database: every password hash, every stored API key, every customer address. A downloadable one is not a leak, it is a total compromise.
Backup plugins drop a .htaccess into the backup directory to prevent exactly that. On nginx, IIS and Caddy that file is never read — so the protection is present, visible, and does nothing.
At a glance
| Ability | updraftplus/check-exposure |
| Toolset | UpdraftPlus — toolset/updraftplus |
| Group | UpdraftPlus › Backup security |
| Requires | UpdraftPlus, active on the site |
| Capability | manage_options |
| Safety | Read-only — changes nothing |
| Repeatable | Idempotent — running it twice leaves the same result |
| Ships in | AcrossAI Abilities Manager 0.0.34 and later |
How it works
This does not inspect configuration and infer a verdict. It asks the running web server for the real URL and reports the status code it actually returned. That is the only method that catches the nginx case.
htaccess_honoured names the underlying problem directly: false on nginx, IIS and Caddy, where the file exists and is ignored.
Every backup directory is checked, not just the default one. A site that has moved its backup path, or runs two backup plugins, has more than one thing to get wrong.
Input
This ability takes no input.
What comes back
| Name | Type | What it is |
|---|---|---|
server | string | The web server actually serving the site. |
htaccess_honoured | boolean | False on nginx, IIS and Caddy, where a .htaccess in the backup directory has no effect. |
directories | array | Each backup directory with the status code it returned. |
exposed_count | integer | How many are reachable over HTTP. |
note | string | Anything else worth knowing. |
success | boolean | Whether the call completed. |
message | string | A one-line summary of what happened, suitable for showing a human. |
error_code | string | Present only on failure — a stable machine-readable reason, such as a missing field, a wrong field type or an unmet confirmation. |
Example
Ask your assistant:
Are our backups downloadable from the internet?
It resolves to one call:
{
"ability": "updraftplus/check-exposure",
"parameters": {}
}Worth knowing
- Read-only and fast. Worth running on every site you take over.
- A non-zero
exposed_countis an emergency, not a to-do. Anyone who guesses the archive name has the database. - The fix is server configuration, not a plugin setting — a location block on nginx, a web.config rule on IIS.
Related abilities
- Get Backup Status — where the backups are stored
- List Backups — what is sitting in those directories
Get the plugins:
AcrossAI Abilities Manager · AcrossAI MCP Manager
Browse the rest: Every ability, by category