Back up cPanel & WHM accounts to Vault
WHM's backup system can send account backups to an S3-compatible destination. This page has the settings, and the one fact that decides your storage bill: to S3, cPanel sends a full backup every run.
bucket.s3.cloudbox.biz. That bucket-in-hostname endpoint needs a wildcard certificate that is being arranged; until this page says it is live, Save and Validate Destination will fail with a certificate error. restic on the server works today, is incremental, and is what we recommend for databases and home directories.1 · Create a key and a bucket
In your CloudBox dashboard → Backup: Create access key (copy the secret now) and Create bucket. One bucket can hold several servers; each gets its own folder.
| Setting | Value |
|---|---|
| Endpoint / server address | https://s3.cloudbox.biz (some tools want just s3.cloudbox.biz) |
| Region | uk-1 — if the tool has no region field, leave it; the gateway accepts the default |
| Signature | Version 4 (V4) |
| Addressing | Path-style (s3.cloudbox.biz/bucket/key). Bucket-in-hostname addressing is not available yet. |
| Access key ID | CBX… from the Backup tab → Create access key |
| Secret access key | shown once when the key is created |
| Bucket | created in the Backup tab; lowercase letters, digits and hyphens, no dots |
| TLS | Yes — a normal public certificate, so leave certificate validation on |
2 · Backup Configuration in WHM
WHM → Backup → Backup Configuration:
- Backup Status: Enable. Backup Type: Compressed.
- Scheduling and Retention: start small — 2 daily, 1 weekly, 1 monthly. Every retained backup on S3 is a full copy (see below).
- Under Additional Destinations, choose Destination Type: S3 Compatible → Create New Destination.
| Field | Value |
|---|---|
| Destination Name | CloudBox Vault |
| Backup Directory | the server's hostname, e.g. svr104 (a folder inside the bucket) |
| Bucket | your bucket name |
| S3 Endpoint | s3.cloudbox.biz |
| Access Key ID / Secret Access Key | from the dashboard |
| Timeout | 300 or more — account backups are large single uploads |
Click Save and Validate Destination. cPanel uploads a small test file and deletes it; the destination shows as validated when that works.
3 · The full-backup trap
cPanel only does incremental backups to an rsync destination. To S3, FTP and SFTP it sends a complete backup of every account on every run. The arithmetic for a 500 GB server:
| Retention | Copies stored | Space on Vault |
|---|---|---|
| 7 daily | 7 | ~3.5 TB |
| 2 daily + 1 weekly + 1 monthly | 4 | ~2 TB |
| 1 daily + 1 weekly | 2 | ~1 TB |
Two ways to keep it small: keep retention counts low and compression on, or back up the data that changes — databases and home directories — with restic on the server, which uploads only what changed and deduplicates across runs.
If something does not work
- Validation fails with a certificate error: the bucket-in-hostname endpoint is not live yet (see the status note at the top).
- Validation fails with SignatureDoesNotMatch: the secret was mistyped, or the server's clock is off by more than a few minutes.
- QuotaExceeded in the backup log: the plan is full — lower retention or move up a plan.
- More in Errors & limits.
Questions
Why is my cPanel backup so large?
cPanel sends a full backup of every account to an S3 destination on every run; only its rsync destination is incremental. A 500 GB server on daily retention of 14 days stores around 3.5 TB on S3. Keep the retention counts low, compress, and back up databases and home directories with restic on the server if you want true incrementals.
Does cPanel work with Vault today?
cPanel's S3 Compatible destination addresses buckets as bucket.s3.cloudbox.biz, which needs a wildcard certificate that is being arranged. Until this page says it is live, Save and Validate Destination fails with a certificate error. restic on the server works today and is incremental.
What does Backup Directory mean?
A folder inside the bucket where cPanel puts its files, so one bucket can hold several servers. Use the server's hostname.
Which retention should I use?
Because S3 backups are full copies, 2 daily, 1 weekly and 1 monthly is a common balance between protection and storage. Every extra retained backup is another full copy.