cPanel Backup and Restore: Files, Databases and Email

Why cPanel Backups Matter More Than You Think

When you manage websites, email and databases on a cPanel hosting account, a failed plugin update, a hacked script, a deleted folder or a corrupted database table can disrupt your site. A clean, recent backup that you can restore with confidence can substantially reduce recovery time.

A clear backup routine should cover entire-account recovery as well as individual sites and email inboxes. This guide explains how to plan those backups and their restoration before an incident.

We will walk through what a full cPanel backup actually includes, how to back up files, databases and emails step by step, where to store backups, and how to restore them safely. Whether you run a single business site, multiple client projects or an email-heavy domain, this article will give you a practical, repeatable backup and restore workflow you can trust.

What a Full cPanel Backup Actually Contains

Before you click any buttons, it helps to understand what a cPanel backup is and what it is not. A full cPanel backup taken from within your account is essentially a compressed archive of account-level files, databases and settings.

A typical full backup contains:

• Home directory files: Website files (public_html and subdirectories), custom scripts, uploaded media, configuration files, logs (depending on settings) and user-level config. Check exclusions and the actual archive contents before assuming every required file is included.
• Databases: MySQL/MariaDB databases attached to the account, including content, users and privileges.
• Email data: Mailboxes, email folders (Inbox, Sent, custom folders), email accounts, forwarders and filters.
• DNS zone settings (when cPanel manages DNS): Zone file for your domains, addon domains and subdomains.
• FTP accounts and settings: Additional FTP users and their directory mappings.

In other words, a full cPanel backup provides an account archive for recovery on the same server or migration to another cPanel server. Confirm target compatibility and arrange administrator access for the full restore.

A few important clarifications:

• Backups are not snapshots of the whole physical server. They include only your cPanel account, not other customers or system-level services.
• The native cPanel interface cannot automatically restore a full account backup. Arrange restoration through WHM with an administrator who has the necessary privileges. Provider plugins may offer separate restoration capabilities. For partial restores, cPanel gives you self-service tools.
• Do not assume a backup captures a changing account at one exact instant. Plan file and database backups to cover the same recovery point. Depending on the application, this may require maintenance mode or pausing writes; choosing a low-traffic period alone does not ensure consistency. For a migration, pause application writes while creating the final backup or plan how to synchronize subsequent changes.

Knowing this helps you decide when a full backup is appropriate (for example, before a big migration) and when partial backups of files, databases or email will be enough.

Backup Types in cPanel: Full vs Partial

cPanel offers two main backup paths:

• Full Account Backups
• Partial Backups: Home directory, individual databases, email forwarders and filters

Full Account Backup

Full account backups are created from the Backup or Backup Wizard interface in cPanel. They cover account-level files, databases and settings and are useful when:

• You are migrating your account to another cPanel server.
• You are making major structural changes (rebuilding the site, changing CMS, hosting multiple new applications).
• You want a periodic full archive (e.g. monthly) of the account for long-term retention.

Limitations to keep in mind:

• Full backups are resource-heavy and can take time on large accounts.
• Plan for a server administrator to restore a full account backup, rather than using cPanel’s partial-restore tools. For reseller accounts or VPS/dedicated setups running cPanel & WHM, confirm who has the necessary restoration access.

Home Directory Backup

A Home Directory backup is a partial backup that includes:

• Website files within your home directory, including public_html and any subdomain or addon-domain document roots located there
• Custom folders in your home directory that belong to your web apps
• Other covered home directory data, including server-side email for your account’s domains

A home directory backup includes files you own and files you can access; inaccessible files you do not own and configured exclusions can leave gaps. Back up databases separately, and inspect the archive before restoring it rather than treating it as a website-only backup. Use a home directory backup when:

• You are making file-level changes (theme updates, plugin uploads, code deployments).
• You want a separate archive of your home directory for file-level recovery.

Database Backups

cPanel lets you download individual database backups (as .sql.gz files) or export via phpMyAdmin. You should back up databases before:

• Applying major CMS or plugin updates (WordPress, Joomla, Drupal, etc.).
• Running SQL scripts that change schema or bulk data.
• Cleaning up or optimizing large tables.

For WordPress users, combining database backups with file backups is essential. Our article on WordPress backup strategies on shared hosting and VPS dives deeper into CMS-specific scenarios.

Email Forwarders and Filters

In the backup interface you will also see options to back up and restore Email Forwarders and Email Filters. These are configuration settings, not the email content itself. Use them when:

• You rely on complex forwarding rules (support queues, distribution lists).
• You have custom filters and want to preserve them during migrations; confirm which rules the export includes before relying on it.

For the actual email messages (Inbox, Sent, folders), confirm that your full or home directory archive contains the required server-side mailbox files. If present, those files can also be extracted manually, as discussed later.

Preparing Your Account for Safe Backups

Good backups start with a bit of housekeeping. Taking a backup of a messy account is better than no backup at all, but a few simple steps will make your backups quicker, smaller and easier to restore.

Check Disk Usage and Quotas

Backups need disk space to be created and stored. A full-account backup can fail when the account is near or over quota because cPanel cannot write required files. Check available space before starting. In cPanel:

1. Log in to cPanel.
2. Look at the Disk Usage or Statistics panel to see how much space you are using vs. your quota.
3. If you are close to your limit, clean up unnecessary files (old backups, staging sites, logs).

If you regularly hit disk limits, you may need a plan with more storage or a VPS/dedicated server. Compare storage quotas and the space needed to generate and retain backups before choosing a package.

Remove Old Local Backups and Temporary Files

Many site owners unintentionally keep multiple .zip or .tar.gz backup files inside their home directory. When you run a new full backup, these files may be included again, wasting space and time.

Before creating a fresh backup:

• Delete old backup archives you no longer need from your account (after ensuring they are safely stored elsewhere).
• Remove unused staging folders and very old test sites.
• Empty cache directories created by plugins (if safe to do so) to reduce size.

Review SSL and DNS Before Major Changes

If you are about to perform a migration or big change, verify that your DNS and SSL configuration is healthy first. Two useful resources from our blog:

• If you are unsure about DNS records, see what DNS records are and how A, AAAA, CNAME, MX, TXT and SRV work.
• To understand free SSL certificates and how to set them up on cPanel, read our Let’s Encrypt SSL setup guide for cPanel.

Backing up a clearly configured environment makes restores much less confusing later.

Step-by-Step: Creating a Full cPanel Backup

Let’s walk through the process of creating a full account backup from the standard cPanel interface. Exact menu names may vary slightly depending on the theme, but the flow is the same.

1. Log In and Open the Backup Tool

1. Log in to your cPanel account.
2. In the Files section, click Backup. The following steps use this interface; Backup Wizard offers a separate guided workflow.

2. Generate a Full Backup

1. In the Backup interface, look for the section labeled Full Backup.
2. Click Download a Full Account Backup to open the Generate a Full Backup interface.

3. Choose Backup Destination

cPanel will ask where you want to store the backup:

• Home Directory: The backup file is generated inside your existing account (usually in /home/username). You will then download it through your browser over HTTPS or via SFTP, if available.
• Remote FTP Server: Sends the backup to a remote server using ordinary FTP. Standard FTP does not encrypt credentials or backup contents in transit; do not use it for sensitive backups over an untrusted network.
• Remote FTP Server (Passive Mode Transfer): Uses passive FTP, which can help with firewall compatibility but does not add encryption. The same credential and data-exposure risks apply.
• Secure Copy (SCP): Sends the backup over an encrypted SSH connection to a remote destination that supports SCP. Confirm destination access and verify the server’s host key before trusting the connection.

For most users, selecting Home Directory and then downloading over HTTPS is the simplest approach. These archives can contain sensitive website, database and email data, so use HTTPS, SFTP or SCP where available and verify the destination’s identity. Do not treat passive FTP as encrypted transport or assume that an FTP option means TLS-protected FTPS. For a remote destination, enter its connection details in the fields cPanel provides. Review any Include integration links option carefully: it may include external account credentials. Sending backups securely to physically separate remote storage can provide the offsite copy in a 3-2-1 strategy. We discuss that more in our article on the 3-2-1 backup strategy and automated backups on cPanel, Plesk and VPS.

4. Enter Email Notification (Recommended)

You will see a field labeled Email Address for completion notification:

• Enter an email address you monitor actively.
• Or select Do not send email notification of backup completion if you prefer to check manually.

On large accounts, backups can take quite a while. The email confirmation helps you avoid downloading an incomplete file.

5. Start the Backup and Wait

1. Click Generate Backup.
2. cPanel will start assembling account files, databases and email data into a compressed archive.
3. If you requested notification, check for the completion email. If you selected Home Directory as the full backup’s destination, refresh the page and wait until the archive is available for download.

Use the actual .tar.gz filename shown for your completed full backup when downloading it; do not rely on a guessed date-and-time naming pattern.

6. Download and Store Offsite

After the backup is ready:

• Click the file name to download through your browser over HTTPS; or
• Use SFTP, if available, to download the file from your home directory to your local machine.

Do not leave full backups sitting in your account indefinitely. After you download and verify them, keep a copy in offsite storage, physically separate from the hosting server or data center. This could be your workstation, an encrypted external drive kept elsewhere, or object storage in a separate location. Restrict access to backup copies, use encryption at rest for sensitive archives, and keep recovery keys available separately. Once the offsite copy is verified, you can delete the account-local archive to free space.

Backing Up Files, Databases and Emails Individually

Full backups are great for big milestones and migrations, but in daily operations you often only need partial backups. cPanel makes it easy to grab just the bits you care about.

Home Directory Backup (Including Website Files)

1. In cPanel, go to Files > Backup.
2. Under Partial Backups, click Home Directory to download a compressed home directory backup.

Use this:

• Before deploying new code or themes.
• Before using the File Manager to perform bulk deletions or moves.
• Before enabling aggressive caching plugins that may change file structures.

Database Backups via cPanel

1. In cPanel, go to Files > Backup.
2. Under Partial Backups, look for Download a MySQL Database Backup.
3. Click the name of the database you want to back up (e.g., user_wp123).
4. Your browser will download a .sql.gz file.

Alternative via phpMyAdmin:

1. In cPanel, open Databases > phpMyAdmin.
2. Select your database on the left.
3. Click the Export tab.
4. Choose Quick and SQL, then click Go.

For WordPress or database-intensive applications, we strongly recommend combining these backups with a regular schedule, as covered in our backup and data retention best practices for SaaS apps. The principles apply equally well to content-heavy websites.

Email Data Backups

There are three layers to email backups with cPanel:

• Account configuration: email accounts, passwords, forwarders, filters
• Server-side mailboxes: the actual message files stored in your home directory
• Client-side copies: if you use POP3/IMAP in a desktop client

1. Forwarders and Filters

1. Go to Files > Backup.
2. Under Partial Backups, download a domain’s email forwarders by clicking its domain name under Forwarders.
3. Download account-level email filters by clicking the filter name under System Filter Info.

The filter download covers only rules from Global Email Filters. It does not include individual mailbox rules configured through Email Filters; do not rely on this download to preserve those rules.

2. Server-Side Mailboxes

Server-side message files and email-account configuration are different parts of a backup; do not treat etc/ as another message-storage directory. cPanel documents that a home directory backup includes files you own, including email for your account’s domains, plus files you do not own but can access. Files you neither own nor can access are omitted, and configured exclusions can omit files or directories. The backup types to check for server-side email are:

• Full cPanel backups
• Home directory backups

A full account archive’s homedir component contains a copy of the account’s home directory. Before relying on either backup type, inspect the archive for the expected email data and account configuration, check exclusions, and test restoration. Server backups cannot recover messages that exist only on a desktop client. Understanding how you access email therefore matters for backup strategy. If you are unsure about POP3 vs IMAP vs webmail, our article comparing POP3, IMAP and webmail for backup and access is worth a read.

3. Client-Side Copies (Outlook, Thunderbird, Apple Mail)

If you use POP3 with “delete from server” enabled, your desktop or laptop may be the only place where some emails exist. In that case you must:

• In classic Outlook for Windows, export the email you need to an Outlook Data File (.pst). Select the correct account, ensure the required messages are fully downloaded, and select Include subfolders. Export each account separately. Where a download-range slider is available, set it to All for a complete export and allow downloading to finish; for Cached Exchange Mode, follow Microsoft’s guidance to turn it off before exporting beyond the current cache. Save the export outside a OneDrive-synced location.
• A PST export copies email and attachments but does not preserve everything: message rules, folder properties and blocked-sender lists are excluded. An OST is not the independent archive workflow: Outlook can recreate an Exchange OST from the server mailbox, which does not make the cache an interchangeable backup of local-only data.
• For Thunderbird, Apple Mail or another client, use a client-specific export or profile-backup procedure and validate its coverage. Keep an independent copy of the resulting backup, inspect the expected accounts and folders, and test restoration before relying on it or deleting the originals.
• Consider IMAP to keep messages on the server for server-side backups, but synchronization is not itself a backup. Switching protocols does not by itself protect messages already stored only on your computer.

Automating Backups with Cron Jobs and Offsite Storage

Manual backups are good, but one missed click can coincide with the one incident you actually care about. Automation reduces reliance on remembering each backup, but scheduled jobs still need monitoring and periodic restore checks.

cPanel’s Built-In Automatic Backups

Providers can schedule backups at the server level. For your chosen plan, confirm whether scheduled backups are included, what they cover, how often they run and how long they are kept.

Key questions to clarify with your provider (or your own DevOps team if you run a VPS/dedicated server):

• Frequency: daily, weekly, monthly?
• Retention: how many days of history?
• Scope: full accounts, only files, only databases?
• Location: stored on the same server or offsite?

Even if automatic provider backups exist, we still recommend having your own independent backups, especially for critical business or customer data.

Cron Jobs and Custom Backup Scripts (VPS / Dedicated)

If you manage a VPS or dedicated server with root access, you can configure cron jobs to:

• Run cPanel/WHM backup routines at specific times.
• Export individual databases on a schedule.
• Sync backup archives to remote storage via rsync, rclone or S3-compatible tools.

We have a detailed walkthrough on this in our article planning automatic tasks with cron jobs on cPanel and DirectAdmin. It shows how to schedule backups, reports and maintenance tasks cleanly.

Offsite and Versioned Backups

Regardless of your hosting type (shared, VPS, dedicated or colocation), your backup plan is strongest when it follows the 3-2-1 principle:

• 3 copies of your data, including the live data and two backups
• 2 different media types (e.g., disk and magnetic tape); an external disk or S3-compatible object store does not by itself establish a different physical media type
• 1 copy offsite (physically separate from your main server or data center)

For example, you might distribute copies as follows. Check the underlying storage media separately before treating this arrangement as meeting every part of 3-2-1:

• The live data on your cPanel account.
• Daily backups on a separate backup server that you or your backup provider maintain.
• Weekly or monthly archives in S3-compatible storage or another region, with at least one copy physically offsite.
• Multiple dated restore points with a defined retention period, rather than a single remote copy overwritten by every sync. Choose the schedule and retention according to how much data loss you can tolerate and how far back you may need to recover.

If you are not yet doing offsite backups and want a practical, step-by-step starting point, our guide on offsite backups with Restic/Borg to S3-compatible storage pairs nicely with the cPanel-level routines described here.

Restoring from cPanel Backups Safely

Backups are only as good as your ability to restore them calmly when needed. cPanel offers self-service restore options for partial backups; full backup restores generally require administrator access.

Important General Rules Before Any Restore

• Always create a fresh backup of the current state before restoring an older one. That way, you retain a recovery option if needed.
• Test the restore in an isolated environment before changing production, with access restricted and live email, scheduled jobs and payment integrations disabled.
• Plan for downtime for the specific sites or services you are restoring, especially databases and email. Stop new application writes during restoration and decide how to reconcile newer orders, user changes or other data that must be retained. A low-traffic window alone is not sufficient. Check file/database compatibility before reopening the site.
• Communicate with your team or clients so they know not to make changes during the restore window.

Restoring a Full cPanel Backup

The native cPanel interface cannot automatically restore a full account backup. Arrange a restore through WHM with an appropriately authorized administrator. There are two typical scenarios:

• Same server restore: Your hosting provider (or you, with the necessary WHM privileges or root access) uses the full backup file to restore account data from that backup.
• Migration to another server: The full backup is uploaded to a new cPanel server and restored there to move your site and email with minimal changes.

On shared hosting, ask your provider whether full-account restores are supported for your plan. Provide the backup’s location through a private support channel and agree on the restore scope and timing before proceeding.

Restoring a Home Directory Backup

1. Log in to cPanel.
2. Go to Files > Backup.
3. Under Restore a Home Directory Backup, click Choose File.
4. Select the previously downloaded home directory backup (.tar.gz file).
5. Click Upload.

cPanel will extract the archive and overwrite existing files with the copies from the backup. This can affect email and other home directory data, not just website files, so inspect the archive and agree on the scope before uploading it. Newer files that do not exist in the backup may be left untouched, but you should assume that anything with the same name will be replaced. Do not treat this as a clean reset that removes every file added since the backup.

Tips:

• If you only need to restore a single website folder or file, consider extracting the backup locally and uploading just that part via SFTP, if available, or cPanel’s File Manager over HTTPS instead of restoring the whole home directory. Verify the destination before uploading; avoid ordinary unencrypted FTP for sensitive files.
• For CMS sites (WordPress, etc.), be careful not to mix files from different plugin/theme versions; ideally restore both files and the matching database backup from the same time.

Restoring Databases

You can restore databases either via the Backup interface or via phpMyAdmin.

Method 1: Using the Backup Interface

1. In cPanel, go to Files > Backup.
2. Under Restore a MySQL Database Backup, click Choose File.
3. Select the .sql.gz file you previously downloaded.
4. Click Upload.

Treat this as a potentially destructive restore to the database named in the backup, not a guaranteed clean replacement of every existing table. Make sure you know which application uses that database, and verify the restored contents before reopening the site.

Method 2: Using phpMyAdmin

1. In cPanel, open Databases > phpMyAdmin.
2. Select the target database on the left, checking its name against the application configuration. For a test restore, use a separate empty database rather than the production database.
3. Click the Import tab.
4. Click Choose File and select your .sql or .sql.gz backup file.
5. Leave defaults unless you know you need specific settings.
6. Click Go to start the import.

The import’s effect depends on the SQL statements in the backup; it can replace data, add data or fail on conflicts. Prefer testing in a separate empty database before changing production. Access phpMyAdmin over HTTPS and check its upload and execution limits before importing. If compressed uploads are unsupported, extract the SQL file first; if the backup exceeds the available limits, agree on an appropriate restoration method with your provider. Do not drop live tables merely to resolve an import error: first preserve a fresh backup, confirm the target and plan the application cutover.

Restoring Email Forwarders and Filters

1. In cPanel, go to Files > Backup.
2. Under Restore Email Forwarders or Restore Email Filters, click Choose File.
3. Select the backup file you downloaded earlier.
4. Click Upload.

Before restoring, preserve the current routing settings and confirm which forwarders and filter types the backup includes. Afterward, verify the restored rules in cPanel and test critical mail routing rather than assuming existing settings were preserved.

Restoring Email Messages

If you lost email content (not just configuration), the options depend on your situation:

• Home directory backup or full cPanel backup available: Ask your provider or server administrator to plan a targeted mailbox restore from the backup; mail data is usually under /home/username/mail/domain/user/. Preserve any newer messages first, and confirm that the mailbox configuration and restored file ownership are correct.
• IMAP client still has messages: Before reconnecting or syncing, preserve an independent local copy of the messages and confirm that their full contents are available. You may then be able to copy them into the restored or recreated IMAP account.
• POP3-only setup: Look for local mail client backups or exported message archives that your client can restore. Also check whether a server backup retains any of the missing messages.

Because email can be tricky to reconstruct, we strongly recommend treating email backups as seriously as website backups, especially for sales and support inboxes.

Testing, Verifying and Maintaining Your Backup Plan

Verification is part of the backup process: use controlled restore tests to check that your backups can recover the data and services you need.

Run Periodic Restore Tests

At least a few times per year, or after any major change in your site architecture, perform a controlled restore test:

• Create a staging subdomain (e.g., staging.example.com) with a separate document root and database, or use a separate test cPanel account with no production data.
• For a subdomain on the live account, extract a recent home directory backup locally and upload only the required website files to the staging document root; do not run a whole-home restore on the live account for this test. Import the matching database backup into the separate staging database.
• Update the staging site’s configuration (database credentials, URLs) as needed.
• Restrict access to staging and disable live email delivery, scheduled jobs and payment integrations before testing. Use sandbox credentials to check key flows such as login, checkout and forms without contacting customers or charging real payments.

This not only validates the backups themselves but also gives you a clear, rehearsed procedure for real incidents. For a broader view on disaster recovery planning, our article on writing a no-drama DR plan with RTO/RPO and backup tests is a good companion read.

Keep a Simple Backup Runbook

Document your backup routine in a small internal guide, for example:

• When full cPanel backups are created (monthly/quarterly)
• When partial backups (files, databases) are created (e.g., daily for DB)
• Where each type of backup is stored (folder paths, remote endpoints)
• Who is responsible for checking backup completion emails
• How to request a full restore from your provider

When team members change or your infrastructure grows (more cPanel accounts, VPS, dedicated servers), this small runbook saves a lot of confusion.

Common Mistakes to Avoid

• Relying solely on provider backups without having your own copies or knowing the retention policy.
• Storing all backups on the same server as the live sites; a hardware issue or ransomware event can take everything at once.
• Not including databases in your backup schedule for CMS-driven sites.
• Keeping only one backup copy that silently becomes corrupted or incomplete.
• Never testing restores until the day something breaks in production.

Wrapping Up: Build a Backup Habit, Not a One-Time Task

cPanel provides backup tools for your files, databases and emails — but using those tools consistently is only part of a recovery plan. A full cPanel backup is your safety net for big changes and migrations; partial backups of the home directory, individual databases and email settings are your daily armor against smaller incidents and human mistakes.

If you combine those tools with a realistic schedule, offsite storage and occasional restore tests, you gain greater confidence in your ability to recover and can identify gaps before an incident.

If you are unsure whether your current hosting plan, disk space or backup setup is enough for your growth, reach out to our team. When assessing a plan, clarify backup responsibilities, storage capacity, retention and restore support so you can choose infrastructure that fits your recovery needs.