What are BackupWall's known limitations?

"Tested" means PortWall ran it. "Untested" means the code accepts it but PortWall has not tried it. Current as of build v278.

The ten that matter most

Backups are not encrypted unless the job has Encrypt backup data on. Even then, file and folder names, sizes, owners, dates, account names, DNS zones and similar details stay readable. See Encrypt your backups.
A backup can finish and still carry warnings. Files that could not be read are named on the point; a failed database dump makes it Partial. Read the point, not only the green status.
Only one backup runs per server at a time. One long first backup can hold the slot for hours while other jobs wait. A run that does nothing for 2 hours is stopped.
There is no whole-server (bare-metal) recovery. BackupWall restores accounts, not the operating system or the panel.
Only a few operating system and panel combinations were tested. CloudLinux is accepted by the installer but has never been run.
Mail that arrives while DNS is still moving during a migration cutover is not handled.
Disaster Recovery is off until you set it up, and a rebuild on a second server of every panel type has not been rehearsed.
Symlinks are stored as links. The data behind a link is not backed up.
Databases: MySQL/MariaDB, PostgreSQL and MongoDB. Redis, Microsoft SQL Server and Elasticsearch are not backed up.
Plesk has no plugin and no customer self-service.

Also in the beta: licensing runs in observe mode, updates are offered but applied only when you approve them, and the engine is shipped as readable Python source.

Systems and panels

Operating systems: AlmaLinux 8 and 9, Ubuntu 22.04 and 24.04 and Debian 12 are tested, but not every system and panel pair: PortWall ran full tests on AlmaLinux 9 with cPanel, DirectAdmin and Plesk, on Ubuntu 24.04 and Debian 12 with Plesk, and on AlmaLinux 8 and Ubuntu 22.04 with no panel. cPanel on AlmaLinux 8 and Ubuntu 24.04 had install and service checks only. DirectAdmin on Debian or Ubuntu and Plesk on Ubuntu 22.04 were not tested. See System requirements. Rocky, RHEL, CentOS, AlmaLinux 10, Debian 11 and Ubuntu 20.04 are untested. CloudLinux 8 and 9 are accepted and never run. Oracle Linux, Fedora and Amazon Linux are refused. ARM (aarch64) is untested; there the faster chunking helper is not shipped and the watcher falls back to slower scans.
cPanel: floor v100; only v136 and v138 tested; Jupiter theme only; the WHM plugin is for root-level users, not resellers. DNS record types cPanel cannot create are not written back on a restore (the restore names each).
DirectAdmin: no version check; 1.697 and 1.710 tested; admin and user level, no reseller level; Evolution skin only; DNS record types DirectAdmin does not take are not written back.
Plesk: no plugin and no customer self-service; Obsidian 18.0.81 and 18.0.82 tested; remote database servers are skipped; SSL It! settings are not carried; mailing lists are not backed up.
Other panels: cPanel, DirectAdmin and Plesk are the only panels. There is nothing for CWP, Webmin, CyberPanel or Hestia.
No panel: needs a local MariaDB or MySQL with a passwordless root socket login and the unix users made first; every first-level folder of /home is an account. See Servers with no control panel.
One BackupWall per server. No multi-server console. The database is SQLite only.

Encryption and secrets

There is a single master key file and no key rotation. Lose it and encrypted backups cannot be read. See Protect the master key.
Turning encryption on for an existing job re-uploads every file encrypted at the next backup; older unencrypted points stay as they are until retention removes them.
An older build cannot restore encrypted points correctly: restore with the same or a newer build.
Treat the destination as secret storage: a private bucket or a locked-down SFTP account.

What is and is not backed up

No ACLs, extended attributes, SELinux labels, file capabilities or chattr flags. Sockets, pipes and devices are skipped. Hard links come back as separate copies and sparse files come back full size.
A file that changes while it is read is not snapshotted. A large appended-to file can be stored torn; the next run fixes it.
Dumps use --single-transaction, consistent for InnoDB only. A database name may contain only letters, digits, _ and -.
MongoDB: one instance, no point-in-time, no replica sets or sharding, unit-tested only.
WP Toolkit, Softaculous and Installatron registries, and PHP ini and FPM pool settings, are not read.
There is no malware scan.
Mount points inside a home are crossed (NFS, FUSE, bind mounts); there is no "one filesystem" option.
A 72-pattern default exclude list applies; see Exclude files and folders.
Server-wide panel settings (WHM tweak settings, EA4 profile, firewall, mail configuration, packages) are not backed up.

Restore and download

Restore adds and overwrites; it does not delete. There is no dry run and no free-space check.
Ownership is restored by name; a failed chown is not reported.
File names of about 250 bytes or more back up but cannot be restored; paths over 4096 bytes cannot be read.
Restore does not translate between panels; use Migration.
The admin console has no download screen; users download from the cPanel and DirectAdmin plugins. Downloads never include mail. Download resume needs the web-server proxy.
Mail restore into a live mailbox is selective (Dovecot indexes are never restored; deleted messages come back with new UIDs).

Running jobs and scale

One backup per server at a time; the worker has two slots shared by backups, restores and migrations; downloads have their own slot.
Scheduling: Every hour, Daily, Weekly and Monthly in the console; other patterns through the API only; no cron expressions; times are server-local and shift by an hour around daylight-saving changes.
Retention is a count only. Space comes back late: a cleanup runs about daily, and a remote pack is rewritten only when it is at least 6 hours old and less than 70% in use.
Deleting a destination only turns it off. Two installs must not share a bucket or folder.
Verification reads a random sample (64 objects, up to 1 GiB per destination) for content.
Scale tested: about 18 accounts, about 130,000 files and about 10 GB per account on 2-CPU servers; a 7 GB migration each way; a 9 GB staged download; and in the Disaster Recovery trial 115 accounts. 100+ accounts of mixed size, an account with a million files and destinations of many terabytes have not been tested. There is no hard limit on size or file count.
About 1.5 GB of RAM is the practical minimum.

Destinations

Tested: Local / NFS, SFTP, Google Drive, S3-compatible (one third-party bucket) and Google Cloud Storage through the S3 type. Amazon S3, Wasabi and Backblaze B2 have had no real runs; native Google Cloud Storage has had none; OneDrive was tested against a mock only. Dropbox is not available.
No settings for Object Lock, versioning, storage class or server-side encryption.
Remote data is not browsable. Nothing copies backups between destinations after the fact.
SFTP pins the host key and at most 4 SSH logins run at once.

Migration

See Migration limits and Cutover and DNS.

Recovery, access and alerts

No whole-server recovery. Rebuild on the same panel type.
Alerts are opt-in and narrow: nothing for a missed schedule, a stopped worker, low disk or an expiring certificate. Delivery is tried once.
No forgotten-password flow; two-factor login has no recovery codes; 10 failed logins lock a username for 15 minutes, doubling to 24 hours.
The audit log is append-only; someone with root access to the database file could still remove that protection.

Licensing and updates

Enforcement is off in the beta. A missing key or unreachable licence service shows a banner and stops nothing.
One licence is one public IPv4 address, one installation and one machine. Several licensed servers behind one public address are untested. A rebuilt server is a new machine to the licence.
The clock matters: a lease stamped in the future puts the server in Grace.
Updates are a signed release file, not a yum or apt package. Builds before v277 cannot be updated or licensed. An update does not change Python packages, service units, install.sh or the panel plugins, waits for the server to be idle, and has a root-command rollback with no button. Modified program files cost you updates.
The updater is not yet hardened against a local attacker who already runs code as the BackupWall service user.
The Stable and Beta channels and the maintenance window arrive after build v278.