Everything BackupWall does
One engine backs up, restores and migrates every account on a server — with a small memory footprint, optional encryption you control, and restores you can trust. Here is the full capability set.
Backup & restore, built to stay small
Bounded-memory engine
Every BackupWall process is designed to stay within about 100–200 MB of RAM, whether an account is 1 GB or 1 TB.
- Files streamed and chunked; large lists kept on disk, not in memory
- Measured peaks of roughly 85–145 MB per service in testing
- Worker capped by a memory limit, so a spike is contained, not fatal
About 1.5 GB of server RAM is the practical minimum.
Incremental & deduplicated
After the first run, a file watcher tracks what changed, so only changed data is read and uploaded.
- Large files cut into content-defined chunks; identical data stored once
- Small objects grouped into ~32 MB pack files on remote destinations
- A 30-day full re-read backstop catches anything the watcher missed
What it captures
For each account, everything needed to put it back:
- Files, MySQL/MariaDB and PostgreSQL databases, mail
- DNS zones, SSL certificates, cron jobs, FTP logins
- The panel settings that recreate the account; a MongoDB job type too
Not the OS, the panel itself or server-wide panel settings — BackupWall is file-level.
Byte-verified restores
Every object is checked against its hash when it is read back, so a damaged object fails loudly instead of restoring quietly wrong.
- A daily integrity check confirms every stored object still exists
- A weekly restore check restores a random sample and compares it
- Verify now on any point, on demand
Schedules & retention
Jobs run every hour, daily, weekly or monthly, as Full or Incremental, at your server’s local time.
- Keep the newest N points per schedule (the console suggests 14)
- A 72-pattern default exclude list for logs, caches and old archives
- Performance presets to yield CPU, disk and bandwidth to your sites
Safety copy & undo
Every overwrite restore first takes a safety copy of exactly what it is about to overwrite, as a backup point of its own.
- Undo this restore puts the previous state back
- Safety copies are kept for 7 days
Encryption, integrity and a way out
Optional end-to-end encryption
Turn on Encrypt backup data per job (off by default) and contents, databases, mail, SSL keys, password hashes and crontabs are sealed with AES-256-GCM before they reach the destination.
- The key lives on your server and in your DR bundle — PortWall never holds it
- Authenticated encryption detects a tampered or wrong-key object
File and folder names, sizes, owners and dates stay readable at the destination, so treat it as secret storage.
Disaster Recovery
DR protects BackupWall itself: it exports its own database and master key as a passphrase-sealed bundle, on a schedule, to a destination you choose.
- Rebuild BackupWall on fresh hardware, then restore every account
- 14 bundles kept; required if you use encryption
Ships off until you set a passphrase — BackupWall never picks one for you.
Read your backups without BackupWall
bw-extract is a single Python file that reads a destination directly, read-only, and writes plain files, database dumps and mail.
- Works with the master key or a DR bundle for encrypted backups
- The storage format is documented — no lock-in
Move accounts, serve customers, stay current
Cross-panel migration
Move an account between any two of cPanel, DirectAdmin and Plesk, in any direction. Files, databases and mail always; DNS, SSL, FTP and cron optionally.
- Re-sync as often as you like, then cut over DNS and proxy web traffic
- Direct push re-keys encrypted backups for the target
Both servers run BackupWall. All six directions tested to ~1 GB; 7 GB between cPanel and DirectAdmin.
In-panel self-service
Account owners list, restore and download their own backups from inside the panel — their own account only.
- cPanel: a BackupWall tile under Files (Jupiter theme)
- DirectAdmin: a user page under Extra Features
Plesk is admin-managed from the console: there is no Plesk plugin and no Plesk customer self-service.
Destinations
Write to the storage you already own, near and far:
- Amazon S3 & S3-compatible (Wasabi, Backblaze B2, MinIO)
- Google Cloud Storage, Google Drive, OneDrive (beta)
- SFTP, and local or NFS folders
Signed updates
Updates arrive as signed release files (not yum or apt packages), offered to licensed servers and verified against a pinned key.
- Notify (approve each version) or Automatic
- Installs only when nothing is running; never interrupts a restore
- Rolls back by itself if the new version is unhealthy
Coming soon Stable and Beta release channels and a maintenance window (such as 02:00–05:00) for automatic installs — added after build v278.
Alerts & notifications
Know when something needs you, on the channel you use.
- Email alerts (opt-in) with beautified HTML summaries
- Slack, Discord and webhooks for backup, integrity, restore and migration events
Licensing that fails open
One licence per server, tied to its public IPv4 address. If it ever lapses, restores never stop.
- Restores, downloads and Disaster Recovery are never blocked
- A 3-day grace with everything running; nothing is ever deleted
During the beta, enforcement is off (observe mode): a lapsed key shows a banner and stops nothing.