moved wp-config and database backup outside of webroot for security