BackupWall frequently asked questions
Short answers to the questions administrators and buyers ask most about BackupWall: what it backs up, where, how it is protected, how restores and migration work, and what happens when a licence lapses.
What is BackupWall?
BackupWall is self-hosted backup, restore and migration software for cPanel & WHM, DirectAdmin, Plesk and panel-less Linux servers, sold by PortWall. It runs on your own server and writes incremental, deduplicated backups to storage you choose. See What is BackupWall?.
Which control panels and operating systems does it support?
cPanel & WHM v100 or newer, DirectAdmin and Plesk, or no panel, on AlmaLinux 8 and 9, Ubuntu 22.04 and 24.04 and Debian 12 (tested). Rocky, RHEL, CentOS, CloudLinux and Debian 11 are accepted by the installer but untested. Windows is not supported. See System requirements.
Is there a Plesk plugin?
No. BackupWall backs up, restores and migrates Plesk subscriptions, but administrators use the console on port 8087 and Plesk customers cannot restore or download for themselves yet. cPanel (WHM admin plus cPanel user) and DirectAdmin (admin plus user) have in-panel plugins. See BackupWall with Plesk.
Does my backup data pass through PortWall?
No. The engine runs on your server and writes straight to your own destination. The only traffic to PortWall is a licence check-in every 6 hours and update downloads. See Security and data handling.
Where can I store backups?
On Amazon S3 and S3-compatible storage (including Wasabi and Backblaze B2), Google Cloud Storage, Google Drive, OneDrive (Microsoft 365 work or school only), SFTP, and local or NFS folders. See Choose and add a destination.
Are backups encrypted?
Only if you switch on Encrypt backup data for the job; it is off by default. With it on, contents, databases, mail, SSL keys, password hashes and crontabs are sealed with AES-256-GCM before they reach the destination. File and folder names, sizes, owners and dates stay readable. See Encrypt your backups.
Who holds the encryption key?
You do. The master key is generated on your server, stored in /etc/backupwall/backupwall.env, and carried in your own passphrase-sealed Disaster Recovery bundle. PortWall never has it, so PortWall cannot read your encrypted backups either. See Protect the master key.
What happens if I lose the master key?
Encrypted backups can never be read again, by anyone, and saved destination passwords cannot be recovered. There is no key rotation and no reset. Set up Disaster Recovery and keep an off-server copy. See Protect the master key.
How much memory does BackupWall use?
Every process is designed to stay within about 200 MB of RAM whatever the size of the data; in tests each service peaked at roughly 85 to 145 MB during backups. About 1.5 GB of server RAM is the practical minimum. See Memory and CPU use.
Are backups incremental and deduplicated?
Yes. After the first run only changed files are read, large files are cut into chunks, and data the destination already holds is not uploaded again. See Incremental and deduplicated backups.
How often can backups run, and how long are they kept?
A job can run every hour, daily, weekly or monthly, as Incremental or Full, and keeps the newest N points per schedule (the console suggests 14). There are no cron expressions or daily/weekly/monthly rotation. See Schedules and retention.
What does BackupWall back up for each account?
Files, MySQL/MariaDB and PostgreSQL databases, email, DNS zones, SSL certificates, cron jobs, FTP logins, mail settings and the panel settings needed to recreate the account. See What is backed up.
Are PostgreSQL and MongoDB backed up?
PostgreSQL databases are backed up with pg_dump on cPanel, Plesk (local PostgreSQL), DirectAdmin and panel-less servers. MongoDB is backed up by a separate MongoDB job type (one instance, unit-tested only). Redis, Microsoft SQL Server and Elasticsearch are not backed up. See Directory and MongoDB jobs.
Can I restore a single file, mailbox or database?
Yes. In Restore → + New restore choose Files only, Databases only, Email only or DNS zones only and tick the specific items. See Restore files, databases, email or DNS.
Can customers restore their own files?
Yes on cPanel and DirectAdmin: account owners restore and download their own backups from the plugin, and can touch only their own account. Plesk has no plugin yet. See Self-service restores and downloads in cPanel.
Can I undo a restore?
Yes. Every overwrite restore first takes a safety copy, kept 7 days, and Undo this restore puts it back. See Safety copy and undo.
Can BackupWall restore a whole server, including the operating system?
No. BackupWall is file-level: it restores accounts, not the operating system, the panel or server-wide panel settings. To rebuild a server you install the OS and panel, install BackupWall, restore BackupWall's state from a Disaster Recovery bundle, then restore all accounts in one action. See Rebuild a server from a DR bundle.
How do I know my backups are good?
BackupWall checks every object against its hash on read, runs a daily integrity check that every object still exists, runs a weekly restore check that restores a random sample into a scratch folder, and has Verify now on every point. See Verify your backups.
Can I read my backups without BackupWall?
Yes. bw-extract is a single Python file that reads a destination read-only and writes plain files, database dumps and mail, with the master key if the job was encrypted. The storage format is documented. See Get your files out without BackupWall.
Can I migrate between cPanel, DirectAdmin and Plesk?
Yes. BackupWall migrates an account between any two of cPanel, DirectAdmin and Plesk (all six directions tested on small accounts and about 1 GB; 7 GB between cPanel and DirectAdmin). Both servers run BackupWall. See Migration overview.
Does a migration move mail without loss?
Mail is moved with the account, but mail that arrives while DNS is still moving is not handled: the cutover proxy carries web traffic only. Lower TTLs, stop mail on the source or run Re-sync after DNS has moved. See Cutover and DNS.
What is Disaster Recovery and is it on by default?
Disaster Recovery exports BackupWall's own database and master key as a passphrase-sealed bundle on a schedule. It is off until you set a passphrase, a destination and a schedule, and BackupWall never picks the passphrase for you. See Set up Disaster Recovery.
What happens to my backups if my licence expires?
Backups pause, but restores, downloads, browsing and Disaster Recovery always keep working, and nothing is ever deleted. A lapse or an unreachable licence service first gives a 3-day Grace with everything running. See What happens if your licence lapses.
Does licence enforcement stop my backups today?
No. During the beta, enforcement is off: a missing key or lapsed licence shows a banner and logs what would be refused, and stops nothing. PortWall will tell beta testers before it is switched on. See How licensing works.
How many servers does one licence cover, and does it depend on the IP address?
One licence covers one server and is tied to that server's public IPv4 address, one installation and one machine. When the IP or hardware changes, BackupWall re-binds automatically or you run python -m app.licensing rebind (3 re-binds per key in any 30 days). See Activate or move your licence.
Does licensing work behind NAT or on a cloud server?
Yes, if the server's outbound traffic leaves from one stable public IPv4 address. A cloud server with a public IP mapped to a private one works; a private or carrier-grade NAT address alone cannot activate. See Licence will not activate.
How do updates work, and are they automatic?
Updates are signed release files offered to licensed servers. By default (Notify) nothing installs until an administrator approves one exact version; you can choose Automatic. The updater waits until no backup, restore or migration is running and rolls back by itself if the new version is unhealthy. See How updates work.
Are there Stable and Beta update channels and a maintenance window?
They are being added: a Stable or Beta release channel, an automatic-install switch and a maintenance window for automatic installs arrive after build v278. See Update channel and maintenance window.
Does BackupWall support CloudLinux?
The installer accepts CloudLinux 8 and 9, but PortWall has never run BackupWall on CloudLinux. CageFS confines cPanel users, not root, so backups read the homes as usual, but this is untested. See BackupWall with cPanel & WHM.
What does BackupWall send to PortWall?
A licence check-in every 6 hours: the key, a random installation id, a hash of the machine id, the build, the last update outcome and a file check of BackupWall's own program files. Nothing about your accounts, backups, destinations or logs. See Security and data handling.
Does BackupWall back up server-wide panel settings such as WHM tweak settings?
No. Server-wide settings (WHM tweak settings, the EA4 profile, firewall, mail server configuration, hosting packages) are not backed up. Per-account settings that recreate an account are. See What is backed up.
Can I back up folders that are not hosting accounts?
Yes. A Directory / system files job backs up any absolute paths you choose, and it is the way to back up what a symlink points at. See Directory and MongoDB jobs.
Can I copy backups from one destination to another?
Not after the fact; nothing copies backups between destinations. A job writes to the destination you choose in the console. Add a second job for a second destination. See Choose and add a destination.
What happens if I upgrade while a backup is running?
The installer restarts every service, the running backup is stopped and its point is marked failed ("Interrupted ..."). Nothing restarts it by itself; the next scheduled run or Run now reuses what was already uploaded. Upgrade when nothing is running. See Upgrade BackupWall by hand.
How do I buy BackupWall and how much does it cost?
BackupWall is ordered through PortWall's billing portal at portwall.net/billing, one licence per server, but it is not yet listed there: it is in a closed beta and keys come with the beta invitation. Plans and prices have not been published. See Order BackupWall and billing.
Is there a trial or refund policy?
PortWall has not published BackupWall trial or refund terms. Ask PortWall through your beta contact or a support ticket. See Order BackupWall and billing.
How do I get support?
Open a ticket at portwall.net/billing (Support → Open New Support Ticket) or write to [email protected]; beta testers use the contact from their invitation. Send a support bundle with every report. See Report a problem and make a support bundle.