How to Back Up Your Website to Amazon S3 (cPanel and WordPress)

Keeping backups only on your web server is risky. If the server fails, gets hacked or your hosting account is closed, the backups go with it. That’s why we also back up websites on Amazon S3, a cheap, extremely reliable cloud storage service that keeps a copy of everything off-site. After setting up backups on our hosting server, adding Amazon S3 as a second destination took only a few minutes. Here’s how to do it in 2026, with cPanel/WHM or a WordPress plugin.

Quick answer: Create an S3 bucket in the AWS console, then create an IAM user with access only to that bucket and generate an access key. Add the bucket and keys as a backup destination in WHM > Backup Configuration, or in a WordPress plugin such as UpdraftPlus. Add a lifecycle rule so old backups are deleted or moved to cheaper storage automatically.

Why back up your website to Amazon S3?

• Off-site: your backups survive even if your server or hosting account doesn’t.
• Reliable: S3 stores data across multiple data centres and is designed for 99.999999999% durability.
• Cheap: S3 Standard costs about $0.023 per GB a month in US regions, and infrequent-access or Glacier storage classes are much cheaper. When we started, our backups were around 6 GB, which cost just a few cents a month.

Check current prices on the Amazon S3 pricing page, as they vary by region.

Step 1: Create an S3 bucket

Sign in to the AWS console, open S3 and click Create bucket. Give it a unique name (like yoursite-backups), choose a region near you, and leave Block all public access turned on. Your backups should never be public.

We already had an AWS account because we used S3 and Amazon CloudFront as a CDN for our theme files, so this was a quick extra step. (If you use CloudFront too, here’s how to clear the CloudFront cache.)

Step 2: Create an access key with limited permissions

Your server needs an Access key ID and Secret access key to upload backups. Don’t use your main AWS account’s keys. Instead:

1. Open IAM > Users and create a user, such as backup-uploader.
2. Attach a policy that allows access only to your backup bucket (list, get, put and delete objects).
3. Under the user’s Security credentials, create an access key and copy both values.

If the key ever leaks, the damage is limited to that one bucket.

Step 3: Add S3 as a backup destination

cPanel / WHM servers

If you manage a VPS or dedicated server with WHM, go to WHM > Backup > Backup Configuration > Additional Destinations, choose Amazon S3, and enter the bucket name, folder and keys.

Click Save and Validate Destination. Your S3 backups start on the next backup schedule. I first worried that S3 would keep every old backup forever, but WHM keeps the same retention as on the server, removing old backups as it goes.

WordPress sites

On shared hosting, use a backup plugin. UpdraftPlus supports Amazon S3 in its free version: go to Settings > UpdraftPlus Backups > Settings, choose Amazon S3 as remote storage, enter your keys and bucket, and set a schedule. Jetpack VaultPress Backup is another option; we’ve used VaultPress for years as an extra layer.

Step 4: Control costs with lifecycle rules

In your bucket’s Management tab, create a lifecycle rule to move backups older than 30 days to S3 Glacier, and delete them after, say, 90 days. Turning on versioning also protects you if a backup is overwritten or a hacker deletes files.

Test your backups

A backup is only useful if it restores. Every few months, download a backup from S3 and restore it to a test site. Keep at least two copies in different places, such as your server and S3. You can never be too safe.

S3-compatible alternatives

Services like Backblaze B2 and Cloudflare R2 work with the same S3 settings in most backup tools and can be cheaper, especially if you download backups often.

Frequently asked questions

How much does it cost to back up a website to Amazon S3?

For most small sites, a few cents to a few dollars a month. You pay for storage and requests, plus data transfer when you download.

Is Amazon S3 secure for backups?

Yes, if you keep the bucket private, use a limited IAM user, and turn on encryption (S3 encrypts new objects by default).

How often should I back up to S3?

Daily for busy sites and stores, weekly for sites that rarely change.