You can chown them to another user like root, then they will not be in the backup even if they are readable by the website user.