How to Set Up cPanel/WHM Backup to a Remote SFTP Server (2026 Guide)

Storing backups on the same server as your data is not a backup strategy — it's a false sense of security. A single server failure, ransomware attack, or datacenter fire eliminates both your production data and your local backups simultaneously. Configuring cPanel/WHM backup to a remote SFTP server moves copies off-site automatically, ensuring your clients' data survives even a total server loss. This guide covers the complete setup from SSH key generation to scheduled backups and verified restores.

Why SFTP Is the Best Remote Backup Transport for cPanel

cPanel/WHM supports several remote backup destinations: FTP, SFTP, S3, Google Drive, and WebDAV. SFTP is the recommended choice for most hosting operations because:

• Encryption in transit: All data travels over SSH — no plaintext credentials or data on the wire
• Key-based authentication: No password to brute-force or leak
• Universal compatibility: Any Linux/BSD server can act as an SFTP backup destination
• Cost-effective: You control the destination server — no per-GB cloud storage fees
• Rsync-compatible: Can be combined with rsync for incremental transfers

Step 1 — Prepare the Remote SFTP Backup Server

You need a second server to receive backups. This could be a cheap VPS at a different datacenter, a dedicated NAS, or a cloud storage server.

# On the REMOTE backup server (SSH in as root)
useradd -m -s /bin/bash backupuser
passwd backupuser   # set a strong password (will be replaced with key auth)

# Create the backup directory
mkdir -p /home/backupuser/cpanel-backups
chown backupuser:backupuser /home/backupuser/cpanel-backups
chmod 700 /home/backupuser/cpanel-backups

systemctl status sshd   # should be active/running
# Verify SFTP subsystem is configured:
grep "Subsystem" /etc/ssh/sshd_config
# Should show: Subsystem sftp /usr/lib/openssh/sftp-server (or similar path)

# On your CPANEL server (as root)
ssh-keygen -t ed25519 -f /root/.ssh/cpanel_backup_key -N "" -C "cPanel backup key"
# This creates:
#   /root/.ssh/cpanel_backup_key      (private key — keep secure)
#   /root/.ssh/cpanel_backup_key.pub  (public key — copy to remote)

# Method 1: Using ssh-copy-id
ssh-copy-id -i /root/.ssh/cpanel_backup_key.pub backupuser@REMOTE_SERVER_IP

# Method 2: Manual copy
cat /root/.ssh/cpanel_backup_key.pub |   ssh backupuser@REMOTE_SERVER_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

ssh -i /root/.ssh/cpanel_backup_key backupuser@REMOTE_SERVER_IP "echo Connection OK && df -h"
# Should connect without prompting for a password

Step 4 — Configure What to Back Up

Under Files in the Backup Configuration:

• Enable Back up accounts
• Enable Back up system files (includes Apache vhosts, Exim config, cron jobs)
• Enable Back up databases (MySQL databases per account)
• Enable Back up email

Under Databases, select Per Account and Entire MySQL Directory for maximum recoverability.

Step 5 — Monitor Backup Success and Storage Usage

# Check backup logs on the cPanel server
tail -50 /usr/local/cpanel/logs/cpbackup/backup-*.log

# Check if backups arrived on the remote server
ssh -i /root/.ssh/cpanel_backup_key backupuser@REMOTE_SERVER_IP   "ls -lh /home/backupuser/cpanel-backups/ && df -h /home/backupuser"

# Set up a cron alert if no new backup arrived today
# Add to root crontab on remote server:
0 8 * * * LATEST=$(find /home/backupuser/cpanel-backups -name "*.tar.gz" -mtime -1 | wc -l);   [ "$LATEST" -lt 1 ] && echo "WARNING: No cPanel backup received today on $(hostname)" |   mail -s "Backup Alert" admin@yourdomain.com

Step 6 — Test a Restore

A backup you haven't tested is not a backup. At least monthly, test restoring a single account:

1. In WHM, go to Backup → Restore a Full Backup/cpmove File

2. Download a backup archive from the remote server to the cPanel server's backup directory

3. Select the archive and restore to a test account name

4. Verify the website, databases, and email are intact on the restored account

5. Delete the test account after verification

A complete off-site backup strategy gives you confidence that any disaster — server compromise, hardware failure, accidental deletion — can be recovered from quickly. CloudHouse Technologies provides managed cPanel/WHM server support including backup configuration, restore testing, and 24/7 monitoring to ensure your backup pipeline never silently fails.