cPanel Remote Automated Backups to AWS S3 & Wasabi (2026)

In web hosting administration, there are two types of webmasters in Pakistan: those who have experienced catastrophic data loss, and those who are about to.

Too many e-commerce operators, digital agencies, and enterprise IT departments rely on local server backups—storing .tar.gz cPanel backup archives inside /backup or /home/backup on the exact same physical drive or virtual disk as their production website.

If a hardware RAID controller fails, an unrecoverable filesystem corruption occurs, or a ransomware script gains root access, your local backups are wiped out alongside your live data. Furthermore, generating and retaining local backup archives quickly consumes 50% or more of your primary storage, triggering disk quota alerts and MySQL table write locks.

Implementing an enterprise-grade 3-2-1 Backup Strategy requires an offsite, physically separated remote storage destination.

In this disaster recovery architecture guide, we demonstrate how to configure cPanel and WHM to stream automated, encrypted daily backups directly to Amazon S3-compatible cloud object storage (such as Wasabi Hot Cloud Storage or AWS S3), configure IAM security policies, and eliminate local disk exhaustion.

---

📐 The 3-2-1 Backup Strategy in Web Hosting

Enterprise compliance standards (and basic common sense) mandate the 3-2-1 rule:

┌────────────────────────────────────────────────────────┐
│               The 3-2-1 Backup Principle               │
│                                                        │
│   • 3 Copies of Your Data                              │
│   • 2 Different Storage Media Formats                  │
│   • 1 Copy Kept Offsite in a Disjoint Facility         │
└────────────────────────────────────────────────────────┘

By streaming backups offsite to object storage:

• Disjoint Failure Domains: Even if a localized power failure, datacenter fire, or catastrophic hardware collapse affects your primary server in Pakistan, your business data resides safely in geo-redundant S3 vaults.
• Ransomware & Immutability: By pairing S3 storage with Object Lock (WORM - Write Once, Read Many), backup archives cannot be deleted or encrypted by ransomware for a set retention window.

---

💰 AWS S3 vs. Wasabi: The Cost Analysis for Pakistani Agencies

While AWS S3 is the industry benchmark, its complex pricing model includes egress bandwidth fees (data transfer out) and API request charges (PUT/LIST).

For high-volume hosting providers and agencies backing up multi-terabyte fleets:

• AWS S3 Standard: Approximately $0.023/GB/month + $0.09/GB egress fee when downloading backups.
• Wasabi Hot Cloud Storage: A flat $0.0069/GB/month (less than 1/3 the cost of AWS) with zero egress fees and zero API request charges.

Because Wasabi exposes a 100% bit-compatible AWS S3 REST API, cPanel connects to Wasabi natively without custom plugins.

---

🛠️ Step 1: Creating an IAM Policy with Least Privilege

Never use root cloud account credentials to configure cPanel backups. Create a dedicated IAM user restricted strictly to the designated backup bucket.

Minimal IAM S3 Policy JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::nextgen-cpanel-backups-pk"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::nextgen-cpanel-backups-pk/*"
    }
  ]
}

Attach this policy to a programmatic IAM user and generate an Access Key ID and Secret Access Key.

---

🔧 Step 2: Configuring Remote S3 Destinations in WHM / cPanel

If you administer a Nextgen Cloud VPS in Pakistan or bare-metal Dedicated Servers with WHM root access:

1. Log into WHM as root.
2. In the search box, type Backup Configuration and select it.
3. Scroll down to the Additional Destinations tab.
4. From the Destination Type dropdown, select Amazon S3™ (or S3 Compatible).
5. Click Create new destination.

Destination Parameter Fields:

• Destination Name: Wasabi-Offsite-Vault (or AWS-S3-Offsite)
• Bucket Name: nextgen-cpanel-backups-pk
• Access Key ID: [Paste Your IAM Access Key]
• Secret Access Key: [Paste Your IAM Secret Key]
• Custom S3 Endpoint (If using Wasabi/Backblaze):
  • For Wasabi EU Central: s3.eu-central-1.wasabisys.com
  • For Wasabi US East: s3.wasabisys.com (Leave blank if using native AWS S3).
• Timeout: 300 seconds.

Click Save and Validate Destination. WHM will upload a small test handshake file to your S3 bucket and report a green confirmation checkmark!

---

⚡ Step 3: Preventing Local Disk Bloat with Staging Flushes

One of the most dangerous default settings in cPanel Backup Configuration is keeping backup archives stored on local disk indefinitely after uploading them to the remote destination.

The Fix in WHM Backup Configuration:

Under the Global Settings section:

1. Ensure “Retain Backups in the Default Backup Directory” is unchecked, OR
2. Enable “Delete local backups after remote transfer completes.”

When enabled, cPanel generates the .tar.gz archive in a temporary staging directory, streams it directly over TLS to your S3 bucket, verifies the MD5 checksum, and immediately deletes the local staging file.

Your server utilizes zero permanent local disk space for backups, allowing you to run comprehensive daily archives even on budget storage configurations!

---

🕒 Setting Smart Retention Cycles

To balance storage costs with disaster recovery objectives:

• Daily Backups: Retain 7 days (Recovers accidental deletions from the past week).
• Weekly Backups: Retain 4 weeks (Recovers compromises noticed after several days).
• Monthly Backups: Retain 3 to 6 months (Archival compliance for accounting and legal audits).

cPanel’s automated backup daemon (/usr/local/cpanel/bin/backup) handles rotational pruning automatically, issuing S3 DeleteObject API calls to purge expired snapshots without manual intervention.

---

🏆 Resilient Cloud Infrastructure with Automated Offsite Protection

True enterprise resilience pairs immutable offsite backups with high-reliability compute:

• Run your development environments and business web portals on Nextgen Cloud VPS in Pakistan featuring dedicated KVM virtual cores, pure NVMe storage, and pre-configured cPanel/WHM licensing.
• For large enterprise database fleets, high-volume e-commerce catalogs, and multi-tenant hosting providers requiring multi-gigabit private backup networks and local PkIX peering, scale on Nextgen bare-metal Dedicated Servers in Pakistan and international Dedicated Servers.

---

📚 Related cPanel, Security & Disaster Recovery Guides

• cPanel File Manager Permissions & CHMOD Guide – Repair broken permissions and eliminate 777 risks.
• cPanel PHP.ini Optimization: Memory Limit & Execution Time – Tune resource baselines for large imports.
• cPanel Cron Jobs Best Practices & Server Optimization – Prevent background script resource spikes.

---