How does BackupWall work with cPanel & WHM?

Supported versions

Floor: cPanel & WHM v100. The plugin installers and the connection test refuse anything older. If the version cannot be read they let it through.
Tested: v136 and v138. Versions 100 to 135 and 137 should work but are untested.
Jupiter theme only for the end-user plugin. There is no Paper Lantern version.

How BackupWall connects

During install, BackupWall creates a scoped, revocable WHM API token named backupwall. When the worker runs as root on the same server it prefers cPanel's local command line (whmapi1 and uapi), which needs no network API; the HTTPS API with the token is the fallback. Uninstalling revokes the token.

The WHM plugin (administrators)

Run bash cpanel-plugin/whm/install.sh from the release folder, after the main install. The full admin console then appears in WHM → Plugins → BackupWall. It is limited to root-level WHM users; WHM resellers cannot open it. The installer refuses to run on cPanel older than v100. See Install the panel plugins.

The cPanel user plugin (account owners)

Run bash cpanel-plugin/cpanel/install.sh (after the WHM one). Account owners get a BackupWall tile under Files in Jupiter where they list their own backups, restore files, databases, email and DNS zones, and download backups. If the tile is missing for a user, open WHM → Feature Manager and check that the feature backupwall is on for that user's feature list. See Self-service restores and downloads in cPanel.

What BackupWall captures on cPanel

Home directories, MySQL/MariaDB and PostgreSQL databases (with users and grants), mailboxes, DNS zones (every record type), SSL certificates, cron jobs, FTP logins, email forwarders, autoresponders and filters, Mailman mailing lists, Roundcube webmail data, and a small metadata-only account archive per point. A restore can recreate a deleted account from that archive and then put the data back on top. See What is backed up.

DNS record types cPanel cannot take

Record types that cPanel's DNS API cannot create (for example SSHFP, SPF and URI records that only a hand-edited zone file holds) are not written back on a restore, and the restore names each one. A record with an empty string, such as CAA 0 issue "", cannot be written either, and while a zone holds one, cPanel's own Zone Editor cannot change that zone.

cPanel-specific limits

BackupWall limits cPanel API calls to two at a time per worker.
cPanel downloads can resume only when the Apache reverse proxy at /backupwall-download is in place. The installer sets it up for EA4 Apache only. LiteSpeed-only or nginx-only cPanel servers were not tested.
The cutover web proxy for a migration needs the root command line and Apache with rewrite, proxy and proxy_http.
CloudLinux is accepted by the installer but has not been run yet. CageFS confines cPanel users, not root, so backups read the homes as usual.