Your main site files belong in the configured web root (often public_html or a domain-named directory). Keeping backups and SQL dumps above the web root is safer than leaving them downloadable.