Support

First, a very important correction since this is a public ticket.

This is NOT a bug. It is a FIX for a bug.

Using the default backup output directory was always a bad idea, as I had written in the Security Information chapter of Akeeba Backup since 2007. While there has always been this warning in place, a bug introduced around version 5.0, if I remember correctly, prevented it from being displayed at all. Therefore people wouldn't know about the risk regarding the use of the default backup output directory.

If you read the page, you know that the best solution is to create a new directory for your backups and modify each and every backup profile to point their Output Directory there. This will make the warning go away.

Also note that if you do not get an error (red box) about your backup output directory being web accessible you can ignore this warning BUT be advised that it's still a bad idea using the default backup directory. You are one server configuration mishap away from unwittingly letting attackers gain access to your backup archives over the web without authentication.

This is one of those things that you're damned if you do and damned if you don't as a developer. Having a default backup output directory is necessary for new users to be able to use the software without having to do some confusing setup that might be above their knowledge level. However, using a default backup output directory makes it easier for hackers to target the backup archives. Telling users about it may be frustrating (as you found out) but not telling you makes the more experienced users and security people allege that we don't care about the security for our users.

The thing is I DO very deeply care about the security of my users and I've made it the banner I fight under since my first public software release. I'd rather people be annoyed at me for taking the extra steps to make their sites safe rather than for putting them at risk. Considering what we read in the news, about companies putting profit over security, I think my approach is better and more honest. But I digress.

If you have already changed your backup output directory in all of your backup profile and STILL get this warning let me know, that would be a bug. If you have questions about why using the default backup output directory is bad that were not answered in the page you read, ask me, I'll be happy to explain.