By default the component uses a non secure location to store its backup files and temporary files, within
your site's file system hierarchy, namely administrator/components/com_akeeba/backup. This
location is well known and can be - theoretically - accessed directly from a web browser. Since the backup
output directory stores the results of your backup attempts, that is SQL files containing database backups and
archive files containing all of your site, a malicious person with access to this location could steal sensitive
information or compromise your site's integrity.
The first line of defense, is to use mangled, hard to guess, names for the SQL backup. However, in the era of multi-MbPS xDSL Internet connections and scripting, it wouldn't take an attacker that long to figure out the filename. Remember: security through obscurity is no security at all!
As a second line of defense, we include a secure .htaccess on the default backup
output directory to disable direct web access. However, this is only possible on Apache-powered web servers
which allow the use of .htaccess files. You should check with your host to ensure that this
kind of protection is possible on your site.
However, this is not enough. Security experts argue that storing backups within the potentially vulnerable system itself might be a security risk. It is possible that a malicious person could gain access via other means. Think of a simple scenario. You have an Administrator with a weak password a hacker eventually guesses. Now the hacker can log in to your site, but doesn't have access to the component. Despite that, you have installed a file administration component, such as eXtplorer, which allows administrators to browse the site's file system and download files. How long would it take before your site got compromised? Right. Not very long indeed!
The best approach is to use a directory which is outside your web server's root. By definition, this is not directly exposed to the web and is usually unavailable to file administration utilities.