Prior to cloning sites, I understand I need to turn off arq, delete backup files, save current htaccess files (root and wp-admin htaccess) so we can restore them later. My question is :
Where are these files located ? I checked plugins/bps-backup folder.. and nothing there or is the saved current secure root htaccess and wp-admin htaccess in the /plugins/bulletproof-security/admin/htaccess folder ?
You should be using the built-in tools to check these things or to do things like Delete Backup Files, etc. Go to the AutoRestore page and you will see all the tools to do everything you could possibly ever need to do. Click on the Blue Read Me help buttons throughout BPS Pro for extensive help information about each section/page of BPS Pro.
You can manually check files and they are located here: /wp-content/bps-backup/ but it is not recommended that you handle files manually – all the tools you need are already built-in to BPS Pro.