Are your website backups public?

Only run these checks on a website you own or manage. Checking someone else's site for exposed files without permission can be an offence under the Computer Misuse Act 1990.

Step 1, in your browser (about five minutes). Open each address below, replacing yourdomain.com with your own domain. For each one, write down what happened: Not found (404), Forbidden (403), a list of files, a download started, a blank page, or it showed your homepage. If a download starts, cancel it. The fact that it started is the answer.

WordPress backup folders:
UpdraftPlus: https://yourdomain.com/wp-content/updraft/
All-in-One WP Migration: https://yourdomain.com/wp-content/ai1wm-backups/
Older database backup plugins: https://yourdomain.com/wp-content/backup-db/
Duplicator: https://yourdomain.com/wp-content/backups-dup-lite/
Your uploads folder (does it list your files?): https://yourdomain.com/wp-content/uploads/

Common archive names in the main folder:
https://yourdomain.com/backup.zip
https://yourdomain.com/site.zip
https://yourdomain.com/public_html.zip
https://yourdomain.com/yourdomain.zip
https://yourdomain.com/backup.tar.gz
https://yourdomain.com/backup.sql
https://yourdomain.com/database.sql
https://yourdomain.com/wp-config.php.bak

Then, if you can, log in to your hosting file manager (cPanel, Plesk or similar), open the website's main folder (often public_html or www) and its wp-content folder, and note any file ending in .zip, .sql, .gz, .tar, .wpress or .bak, with its size and date. Guessing names only catches the common ones; the file manager shows everything.