diff --git a/source/script.php b/source/script.php
index 0ceb68d..8c64545 100644
--- a/source/script.php
+++ b/source/script.php
@@ -213,12 +213,60 @@ class Pkg_MokoJoomBackupInstallerScript
 			}
 		}
 
+		if ($type === 'uninstall') {
+			return;
+		}
+
 		// Sync submenu icons in #__menu (Joomla doesn't update icons on upgrades)
 		$this->syncMenuIcons();
 
-		// Warn if no license key configured (skip on uninstall)
-		if ($type !== 'uninstall') {
-			$this->warnMissingLicenseKey();
+		// Warn if no license key configured
+		$this->warnMissingLicenseKey();
+
+		// Warn if any profile still uses the default backup directory
+		$this->warnDefaultBackupDir();
+
+		// Remind user to review backup profile settings
+		if ($type === 'install') {
+			$profileUrl = Route::_('index.php?option=com_mokojoombackup&view=profiles');
+
+			Factory::getApplication()->enqueueMessage(
+				'<strong>Review Your Backup Settings</strong> — '
+				. 'A default backup profile has been created. Review the profile settings to configure '
+				. 'backup type, schedule, storage location, and notifications. '
+				. '<a href="' . $profileUrl . '" class="btn btn-sm btn-primary ms-2">Review Profiles</a>',
+				'info'
+			);
+		}
+	}
+
+	private function warnDefaultBackupDir(): void
+	{
+		try {
+			$db    = Factory::getDbo();
+			$query = $db->getQuery(true)
+				->select('COUNT(*)')
+				->from($db->quoteName('#__mokojoombackup_profiles'))
+				->where($db->quoteName('published') . ' = 1')
+				->where('(' . $db->quoteName('backup_dir') . ' = ' . $db->quote('administrator/components/com_mokojoombackup/backups')
+					. ' OR ' . $db->quoteName('backup_dir') . ' = ' . $db->quote('[DEFAULT_DIR]')
+					. ' OR ' . $db->quoteName('backup_dir') . ' = ' . $db->quote('')
+					. ' OR ' . $db->quoteName('backup_dir') . ' IS NULL)');
+			$db->setQuery($query);
+
+			if ((int) $db->loadResult() > 0) {
+				$profileUrl = Route::_('index.php?option=com_mokojoombackup&view=profiles');
+
+				Factory::getApplication()->enqueueMessage(
+					'<strong>Backup Directory Warning</strong> — '
+					. 'One or more profiles store backups in the default directory inside the web root. '
+					. 'For better security, configure a backup directory outside the web root. '
+					. '<a href="' . $profileUrl . '" class="btn btn-sm btn-warning ms-2">Edit Profiles</a>',
+					'warning'
+				);
+			}
+		} catch (\Throwable $e) {
+			error_log('MokoJoomBackup: warnDefaultBackupDir() failed: ' . $e->getMessage());
 		}
 	}