What a good backup setup looks like

• ✓ Automatic: backups run on a schedule, without anyone remembering to start them.
• ✓ Off-site: at least one copy lives on a different server or storage service.
• ✓ Kept long enough: you keep several days or weeks, so you can go back before a problem started.
• ✓ Tested: you have restored from a backup at least once, and you know it works.
• ✓ Secure: no plain-text passwords in scripts, and backups are not reachable from the web.

Option 1: server-wide backups in WHM (recommended)

If you have root access to WHM, this is the most reliable method. It backs up every account, including files, databases, email and settings.

1. Log in to WHM as root.
2. Go to Backup > Backup Configuration and turn on Enable Backups.
3. Choose the backup type. Compressed saves the most space. Incremental is faster after the first run but cannot be sent to every destination.
4. Set the schedule (daily, weekly or monthly) and how many copies to keep.
5. Under Files, back up user accounts and, if you want, system files.
6. Under Databases, choose to back up databases per account, the whole MySQL folder, or both.
7. Under Additional Destinations, add an off-site destination, such as SFTP, an S3-compatible storage service, or another backup server. Use the Validate button to test it.
8. Save the configuration.

To start a backup straight away instead of waiting for the schedule, run this as root:

/usr/local/cpanel/bin/backup --force

Backup logs are in /usr/local/cpanel/logs/cpbackup/. Check them after the first run, and set up a WHM notification so you hear about failures.

Option 2: account-level backups from cPanel

Without root access, you can still back up your own account. In cPanel, open Files > Backup or the Backup Wizard. You can download a full backup, or partial backups of your home folder, databases and email forwarders and filters.

Full backups can only be restored by the server administrator, while partial backups can be restored from the same page. Keep both if you want the most options.

Option 3: schedule account backups with cron (no passwords)

cPanel’s Backup API can create a full account backup from a cron job. Send it to another server with an SSH key, not a password, so no secret is stored in the cron line.

Step 1: create an SSH key for backups

In cPanel, open Security > SSH Access > Manage SSH Keys and generate a key. Add the public key to the backup user on the destination server. Give that user access only to its backup folder.

Step 2: add the cron job

In cPanel, open Advanced > Cron Jobs and add a job, for example daily at 3:30. Replace the host, user, key name and folder with your own:

uapi Backup fullbackup_to_scp_with_key host=backup.example.com username=backupuser key_name=backupkey directory=/backups/myaccount email=you@example.com

cPanel sends an email to the address you set when the backup finishes, so you know whether it worked. To keep a copy in your home folder instead, use uapi Backup fullbackup_to_homedir, but remember that a copy on the same server does not protect you if the server fails.

What cPanel backups do not include

Account backups cover what lives inside the cPanel account. They do not cover everything on the server:

• Databases outside MySQL or MariaDB, such as MongoDB or Redis data. Back these up with their own tools.
• Custom server settings, such as hand-edited Apache, PHP or firewall configuration, unless you also back up system files.
• Files stored outside the account’s home folder.

List anything else your sites depend on, and add it to your backup plan.

How long to keep backups

Keep at least one older copy as well. Malware and data errors are often noticed days after they happen, so a backup from last night may already contain the problem.

Test a restore

A backup you have never restored is a guess. At least once a quarter:

1. Restore one account or one database to a test location, not over the live site.
2. Check that the site loads and recent data is there.
3. Write down how long it took, so you know what to expect in a real emergency.

Administrators can restore accounts in WHM > Backup > Backup Restoration, or single files in File and Directory Restoration. For command-line restores, see our guide to backing up and restoring a cPanel account over SSH.

Troubleshooting

For more on protecting your data, see our guide to off-site cPanel backups and creating account backups over SSH.