On Pro, Remove unwanted files runs a daily cleanup that deletes common leftover files from the WordPress root and matching backup dumps. The firewall can also block access to patterns like .bak and .sql when those rules are active.

Enable it under Security Ninja → Fixes.

Files and patterns removed (5.303)

Exact names:

wp-config.php.old: Config backup: can contain credentials
wp-config.php_bak: Config backup: can contain credentials
wp-config.php~: Config backup: can contain credentials
wp-config.php-: Config backup: can contain credentials
wp-config.php--: Config backup: can contain credentials
wp-config.php---: Config backup: can contain credentials
wp-config.php.bkp: Config backup: can contain credentials
wp-config.php_revision: Config backup: can contain credentials
php_errorlog: May expose server details or errors
php_mail.log: May expose user details or errors
.htaccess.sg: SiteGround .htaccess backup
.htaccess_swift_backup: Swift Performance .htaccess backup
phpinfo.php: Exposes full PHP environment details
info.php: Dev leftover
test.php: Dev leftover

Wildcard cleanup:

*.sql: Database dumps
*.bak: Old file copies
deleteme.wp*.php: Installer leftovers

This cleanup does not replace deleting readme.html yourself. See Secure or remove readme.html.

Related: Fixes overview.