The 3-2-1 backup rule — three copies, two media, one off-site — was written for enterprise filesystems, but it maps cleanly onto shared hosting. The trick is picking which tool covers which leg without paying twice. This guide compares the four realistic options for cPanel hosts in 2026 — cPanel built-in, JetBackup, R1Soft, and offsite-only — and gives a concrete recommendation by fleet size.
The honest answer up front: there is no single best stack. The right choice depends on how many accounts you have, what RTO and RPO you promise customers, and how much storage you can afford to throw at the problem.
The four options
| Option | Backup level | Off-site | Self-service | Cost shape |
|---|---|---|---|---|
| cPanel built-in | Account (tar) | SFTP, S3-compatible, Google Drive | Yes (basic) | Free with cPanel |
| JetBackup | Account / file | S3, Wasabi, B2, SFTP, more | Yes (excellent) | Per-server license |
| R1Soft | Block-level (kernel) | SBM-to-SBM replication | Limited (plugin) | Per protected machine + SBM hardware |
| Offsite-only (rsync/borg) | File | Whatever you script | None | Storage cost + your time |
Apply 3-2-1 to shared hosting
You want, at minimum:
- Copy 1 — primary data on the cPanel server itself
- Copy 2 — recent backups on a second medium (a separate volume or a second host)
- Copy 3 — at least daily backups in a different physical location (different DC, different region, different provider)
cPanel built-in alone covers copy 2 if you point it at a separate disk, and copy 3 if you point it at SFTP off-site. JetBackup covers 2 and 3 with better UX and cheaper off-site storage via Wasabi or B2. R1Soft covers 2 with deduplication wins, and 3 via replication to a second SBM.
Recommendation by fleet size
Small (1-3 servers, under 50 accounts each)
Use cPanel built-in with an off-site SFTP target on a cheap VPS or Hetzner storage box. Cost is essentially free beyond the storage. The built-in is unfashionable but it works, restores are reliable, and at this scale the ergonomic gap with JetBackup does not justify a license cost.
If you also want end-user self-service that does not embarrass you, layer JetBackup on top.
Mid (3-20 servers, 50-500 accounts each)
This is JetBackup's sweet spot. Run JetBackup on each cPanel server with Wasabi or B2 as the off-site destination — both cost roughly $6/TB/month with no egress fees, which is the cheapest realistic off-site for cPanel-shaped data in 2026.
Storage budget for 20 servers averaging 200 GB of customer data with 30-day retention: roughly 6-8 TB of off-site storage, so $40-50/month. Compare that to your R1Soft SBM hardware cost and the maths favours JetBackup at this scale.
Large (20+ servers, multi-DC)
Run both R1Soft and JetBackup. The combination is the operational standard for serious cPanel shops and the cost gap is justified by the failure modes each one covers — see the R1Soft vs JetBackup comparison for the per-tool breakdown.
- R1Soft for full DR, bare-metal recovery, and storage efficiency on dense servers
- JetBackup for end-user self-service and fast per-account restores
- Off-site for both — R1Soft via SBM-to-SBM replication, JetBackup via Wasabi or B2
Yes, this is paying twice. At scale, both pay back via a single avoided incident.
Cost per TB stored monthly (back-of-envelope)
| Destination | Cost per TB / month | Notes |
|---|---|---|
| Wasabi | ~$7 | No egress fees, 90-day minimum retention |
| Backblaze B2 | ~$6 | Egress 3x storage cost |
| AWS S3 Standard | ~$23 | Egress kills the maths at restore time |
| Hetzner Storage Box | ~$2-4 | SFTP/S3 — best raw $/TB, fewer regions |
| Self-hosted SBM (HDD) | ~$1-2 | Once amortised over 3 years |
For most hosts, Wasabi for JetBackup destinations and a self-hosted secondary SBM for R1Soft is the best $/TB.
RTO and RPO targets
Be honest with yourself about what you promise. The targets you can hit with each stack:
| Stack | RPO | RTO |
|---|---|---|
| cPanel built-in daily | 24 hours | 2-8 hours per account |
| JetBackup hourly | 1 hour | 5-30 minutes per account |
| R1Soft 15-min | 15 minutes | 30-60 minutes per server (bare metal) |
| R1Soft + JetBackup | 15 min / 1 hour | Account: 5-30 min; Bare metal: 30-60 min |
These are realistic numbers under load, not marketing copy.
Common mistakes
Treating backups as done once they run. Schedule monthly restore drills. A backup that has never been restored is not a backup.
One off-site destination per provider. If your primary servers are at Hetzner and your S3 is also at Hetzner, you are exposed to a single-provider event. Use a different provider for off-site.
Counting the source replica as a backup. A live MySQL replica or a DRBD pair is HA, not backup. It will replicate the DROP DATABASE cleanly.
Skipping config and customer email. Account backups capture /home. Server config, custom plugins, MTA queues, and DNS zones often live elsewhere. Inventory before you trust the backup.
What to do this week
If you have nothing in place: enable cPanel's built-in tonight, point it at an off-site SFTP, and queue JetBackup as a Q3 project. If you have JetBackup but no off-site: configure Wasabi today. If you have both but no R1Soft and you are over 20 servers: it is time. Start with the R1Soft vs JetBackup comparison to scope cost.
For the comparison against cPanel's own backup tool, see JetBackup vs cPanel built-in backups. To buy or renew JetBackup licenses, see the JetBackup license page.
Next steps
- Compare engines: JetBackup vs cPanel built-in.
- Compare engines: R1Soft vs JetBackup.
- Buy or renew: JetBackup license.