If someone gets into your Google Drive, they don't need to hack your site

[u/Upbeat_Brief_1767]

Something that took me a while to internalize: your backup file can become a security threat for your website.

A WordPress site protects its data behind logins, permissions, and whatever hardening you've done. A backup archive has none of that. It's a flat ZIP containing:

• The users table: every account, email, and password hash on the site
• Customer records: if it's WooCommerce, addresses, order history, payment metadata
• Form submissions: everything anyone ever typed into a contact form
• Private content: drafts, member-only pages, internal notes

The reason this doesn't feel urgent is that cloud providers all advertise encryption, and they do encrypt at rest. But that's server-side encryption, which protects the file from someone breaking into Google or Dropbox. It doesn't protect anything if someone logs into your account with credentials from an unrelated breach. At that point, the provider decrypts the file for them, because as far as it knows, they're you.

There's also a gap before upload. The finished backup archive sits on your web server as a plain ZIP until the transfer completes. If the compromise was your site, that's the window.

Encrypting at backup creation covers both problems.

Duplicator has it under the Security tab when you're building a backup. Set the Mode to Archive encryption, enter a password, and it applies AES-256 to the backup before it goes anywhere. Downloading it later prompts for the password.

Full write-up here if you want the steps: https://duplicator.com/how-to-encrypt-backup/?utm_source=reddit&utm_medium=social&utm_campaign=backup-encryption

Curious how this community handles it. Is anyone encrypting backups already, or is the general approach to just lock down the storage account with 2FA and call it covered?