ZIP and Unzip on Linux: Create, Test and Extract Safely

Use zip to create a ZIP archive and unzip to inspect or extract it. Install maintained packages from your supported distribution if the commands are missing; a broad operating-system upgrade is not a prerequisite for practicing this task. Check the installed manuals because options vary by implementation.

Create a ZIP including dotfiles

This fixture uses a new private directory and contains no live website data. Run all blocks in the same Bash session.

umask 077
lab=$(mktemp -d)
cd "$lab" || exit 1
mkdir -p source/cache
printf 'page\n' > source/index.html
printf 'setting=yes\n' > source/.settings
printf 'temporary\n' > source/cache/item.txt
zip -r site.zip source -x 'source/cache/*'
unzip -l site.zip
unzip -t site.zip

The explicit directory operand includes hidden files. A command ending in * commonly misses them. Write the archive outside the source tree. -r recurses; exclusions must match the names stored in the ZIP. A test checks archive structure/data integrity, not whether every required website file or database was captured.

Extract without overwriting a live site

mkdir restore
unzip site.zip -d restore
cmp source/index.html restore/source/index.html
cmp source/.settings restore/source/.settings

-d selects the destination directory; it does not select which member to extract. The stored source/ prefix remains in the restored path. Inspect paths, symlinks and expanded sizes first; use a fresh unprivileged destination for trusted archives, and stronger isolation for untrusted content. Do not extract as root over system or website files.

To extract one named member into another fresh directory:

mkdir selected
unzip site.zip 'source/index.html' -d selected
cmp source/index.html selected/source/index.html

Update or remove members deliberately

Adding files to an existing named ZIP updates that archive. Work on a copy before modifying a recovery artifact. In Info-ZIP, zip -d deletes matching members; this is different from unzip -d. Confirm exact names with unzip -l. Avoid unattended overwrite flags unless a verified destination and rollback plan make them appropriate.

Password protection and recovery limits

Traditional Info-ZIP encryption is weak and unsuitable protection for sensitive backups. Do not publish passwords on a command line, in shell history or in a web-accessible script. Use an approved modern encrypted backup/archive workflow with separately protected recovery material and compatible recipient tools. Compression is not encryption.

A website may require database exports, private configuration, uploads, permissions and external service settings beyond the ZIP. Verify a recovery in isolation before replacing newer live content. Keep backups outside the public document root and outside the server’s failure domain.

References: Info-ZIP FAQ and encryption limitations and archive security considerations.

Reviewed October 15, 2026. The three practice blocks were executed on synthetic files with Info-ZIP tools in a disposable container; no full website restore was tested.