Plesk Backup Manager: ship backups to S3, Wasabi, or B2

Plesk Backup Manager handles full-server and per-subscription backups out of the box, but the default local-disk target gets you killed the moment the box itself fails. Remote storage is what makes the backup load-bearing, and Plesk's S3 connector covers AWS S3, Wasabi, Backblaze B2, DigitalOcean Spaces, and MinIO from a single config screen.

This walks through bucket setup, the Remote Storage form in Plesk, the four endpoint URLs you'll actually use, and what to check when uploads stall or restores fail.

Before you start

Confirm Plesk Obsidian 18.0.40 or newer — earlier builds shipped an S3 connector that only signed AWS-native URLs and choked on custom endpoints:

plesk version | head -3

Make sure the Backup Manager component is installed (the standard image ships it, but minimal installs strip it):

plesk installer --select-release-current --install-component panel-backup

You'll also want an outbound HTTPS path to your storage provider. Wasabi and Backblaze B2 both publish their endpoint IP ranges if your egress firewall is whitelist-style.

Create the bucket and a scoped key

Whichever provider you pick, the recipe is the same:

1. Create a bucket in the region closest to the Plesk server. Cross-region uploads are slow and, on AWS, billed.
2. Block all public access — Plesk encrypts backups only if you tell it to.
3. Create an IAM user or sub-account scoped to the single bucket. Never reuse root credentials.

The bucket policy needs five S3 actions — anything narrower breaks Plesk's post-upload verification step:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ],
    "Resource": [
      "arn:aws:s3:::plesk-backups-acme",
      "arn:aws:s3:::plesk-backups-acme/*"
    ]
  }]
}

Save the access key ID and secret — Wasabi, B2, and DO Spaces all show the secret exactly once.

Configure Remote Storage in Plesk

In the panel go to Tools & Settings → Backup Manager → Remote Storage Settings → Amazon S3 Backup. This single screen handles every S3-compatible provider; the separate "Backblaze B2" tab uses B2's native API and is slower and harder to scope — prefer B2's S3 endpoint instead.

Tick Use this remote storage, then fill in:

• Use a custom S3-compatible service — enable for Wasabi, B2, DO Spaces. Leave off for AWS.
• Service endpoint — see the table below.
• Bucket name — without s3:// prefix or trailing slash.
• Backup folder — optional path inside the bucket, e.g. plesk/server01. Useful when one bucket holds backups from several Plesk servers.
• Access Key ID / Secret Access Key — from the scoped IAM user.
• Use path-style URLs — enable for Wasabi and B2 to avoid DNS issues with hyphenated bucket names.

Endpoint cheatsheet

Click OK. Plesk uploads a small test object, lists it back, then deletes it. A green tick means the policy works; a 403 means you're missing one of the five IAM actions above.

Encryption and retention

Encryption is set globally per backup type, not per remote storage. In Backup Manager → Settings:

• Use password protection — turn it on, set a passphrase, store it in a password manager. Lose the passphrase and the backups are unrecoverable; Plesk has no key escrow.
• Maximum number of backups in storage — Plesk's retention knob. It deletes the oldest backup once the count is exceeded.

Provider-side encryption (SSE-S3 on AWS, automatic AES-256 on Wasabi) is transparent to Plesk and stacks on top of the passphrase encryption.

Verify a backup actually landed

Schedule a small server-config backup first — fastest way to confirm everything works without uploading 200 GB of customer data.

In Backup Manager, click Back Up → Server configuration only, target the remote storage, and run. Watch progress in Tools & Settings → Background Tasks, or tail the backup log:

tail -f /usr/local/psa/PMM/sessions/*/backup.log

Once it finishes, list the bucket from the server itself with the AWS CLI:

aws --endpoint-url https://s3.us-east-1.wasabisys.com \
    s3 ls s3://plesk-backups-acme/plesk/server01/ --recursive

You should see a .xml index and one or more .tar chunks under a timestamped directory.

Common failure modes

• "Failed to read backup metadata" on a freshly uploaded backup — bucket policy is missing s3:GetObject or s3:ListBucket. The upload succeeds but Plesk can't list it back. Fix the policy and the existing backup becomes restorable without a re-upload.
• Connection times out — usually outbound firewall, less often DNS. Test from the server: curl -v https://s3.us-east-1.wasabisys.com.
• "The request signature we calculated does not match" on B2 or Wasabi — region field doesn't match the endpoint region. Endpoint hostname and region code in the form must agree.
• Slow uploads (under 10 MB/s) — Plesk's S3 client doesn't parallelise multipart chunks. On a busy server back up locally and sync with rclone, or run JetBackup on the cPanel side of the fleet for parallel uploads.
• Pruning silently stops working — the IAM user is missing s3:DeleteObject. The bucket fills up indefinitely with no error in the UI; check the bucket size monthly until you've confirmed deletes work.

Next steps

• Activate the panel with a current Plesk license before wiring backups into production.
• If you want per-customer self-service restores, compare Plesk Web Pro vs Web Host tiers — Web Host exposes per-subscription Backup Manager to resellers.
• For mixed fleets, see the 2026 backup strategy for cPanel hosts — the storage maths and 3-2-1 layout apply identically to Plesk.