All fixes

Remove a public wp-config backup

exposed-wp-config

A backup copy of wp-config.php is served as plain text, so your database password and WordPress auth keys are readable. Remove it and rotate.

Why this matters

A backup of your WordPress config file is publicly accessible. It contains your database password, secret keys, and other credentials in plain text.

Nginx

  1. 1 Block access to wp-config files
nginx 
location ~ /wp-config {
    deny all;
    return 404;
}

Does your app still have this?

Scan your domain