Configure WHMCS Database Backups and Preserve Recovery Keys

WHMCS database backups contain sensitive billing, account and support information. Configure them through an authorized self-hosted WHMCS administrator, with protected storage and independent recovery material. A database export alone does not preserve every file, attachment or encryption dependency.

Choose an appropriate delivery route

Open Configuration > System Settings > Database Backups in current documented versions; Setup > Other is a historical menu. WHMCS documents secure SFTP, legacy FTP, email and a separate cPanel backup request option. Prefer an approved encrypted transfer and protected destination rather than sending billing databases through plaintext FTP or ordinary email.

1. Select the supported method for your installed version and enter the scoped destination account and path.
2. For SFTP, select the secure option and verify the destination identity according to the product’s supported configuration. Do not bypass trust checks to make a test pass.
3. Use the available connection test, then Save & Activate. Confirm the system cron and backup task actually run and that a completed artifact reaches the destination.
4. Monitor failures, capacity and retention. A connection test or saved setting is not a completed backup.

Preserve the decryption dependency

Keep a protected backup of the matching configuration.php file, including the installation’s encryption material, separately from public storage. Losing that material can make encrypted database values unrecoverable. Also inventory custom files, attachments and configured external storage needed for your installation.

Understand limits and verify recovery

Email backups can fail on larger databases and create additional copies of sensitive records. WHMCS’s cPanel option requests a backup; its documentation says that this does not itself detect completion, move the file or send completion notification. Verify the downstream task independently.

Test recovery in a contained installation with live provisioning, payment, registrar, mail and automation side effects disabled. Verify access to encrypted settings without publishing them. These procedures do not establish WHMCS Cloud behavior or any InterServer automatic-backup schedule.

References: documented self-hosted backup methods and limits; configuration dependency and recovery.

Reviewed October 15, 2026. Documentation review; no billing data, backup destination, credentials or automation was accessed or executed.