One SQL file can contain every customer your business has ever had. People guard their website's login with a strong password, then leave its entire database sitting in a downloads folder. Do not be that story.
Downloading your own websites' databases is normal, necessary work. But the file you get is the whole business in one document — names, emails, password hashes, addresses, orders. This page is about treating it that way from the moment it lands on your disk.
Open any dump and you will see readable INSERT statements — the actual data, not an encrypted blob. Passwords are stored as hashes by any decent platform, but hashes can be attacked offline, and emails plus order history are sensitive on their own. This is also why these methods are for websites you own or administer with permission — in the wrong hands the same file is a breach.
Keep working copies on an encrypted disk or folder (BitLocker, FileVault, or an encrypted archive with a strong password). A backup that travels — to cloud storage, to a colleague, to a new host — should travel encrypted, with the password shared by a different channel than the file itself. A plain .sql in a synced public-link folder is an accident waiting for a date.
Retention is a safety feature: decide how many generations you keep (for example, the last four weekly backups per site), and delete the rest completely. Every extra forgotten copy on an old laptop is extra exposure with zero benefit. Migration finished and verified? The intermediate copies can go.
Test imports and staging copies recreate the same data in new places. Give test databases the same respect — password-protect them, keep them off the public internet, and drop them when the test ends. A staging site with real customer data and a weak admin password is a classic breach story.
The full bulk database download process — live demo, every step on screen.
▶️ Watch Full VideoA decent platform stores passwords as hashes, not plain text — you will see hashes, not the passwords themselves. But hashes can be cracked offline, and the emails and personal details around them are plain text, so the file still needs full protection.
Yes, if the account is protected with a strong password and two-factor authentication, and ideally the files are encrypted before upload. Avoid public or 'anyone with the link' sharing for database files entirely.
Long enough to recover from a problem you notice late — a few generations is typical for a small site. Beyond that, delete them properly. Keeping every backup forever increases risk, not safety.