How to Backup and Restore Joomla Securely

⚡ Quick Answer

Joomla has no built-in backup system, so the safest method is a dedicated extension such as Akeeba Backup: create a full site-plus-database archive, copy it off-server to cloud or remote storage, automate it on a schedule, and periodically test a restore with Kickstart before you actually need one. A recent, tested backup is what turns a hack or a failed update into a 10-minute fix instead of a rebuild from scratch.

📋 What you'll need	Details
Joomla admin access	Super User account on the backend (/administrator)
FTP/SFTP or File Manager access	Provided by your hosting control panel (cPanel, Plesk, etc.)
Remote storage location	Cloud drive, S3-compatible bucket, or a second FTP/SFTP server — needed for off-server copies
Free disk quota	Roughly the size of your site files + database; more if you keep several archives
Time	15–20 minutes for initial setup, a few minutes for each backup afterward

This guide covers Joomla 6.1.x and the 5.4.x LTS branch, using Akeeba Backup (the most widely used Joomla backup extension) as the primary tool, plus the manual fallback method and the restore workflow with Kickstart. It applies whether you're backing up ahead of a core update, an extension install, or simply running routine protection for a live site.

Why Joomla Backups Need a Dedicated Strategy

Joomla does not ship with a native, one-click backup feature. That gap is one of the more common reasons sites lose data — not because the site was insecure, but because there was no recent, working backup to fall back on after a bad update, a compromised extension, or a hosting-side failure. A backup plan closes that gap by giving you a known-good restore point at all times.

🖼️ [SCREENSHOT NEEDED] Hero image — a Joomla admin dashboard with a backup/restore concept overlay (e.g., archive icon + cloud icon), used as the article's featured image

Alt text: "Joomla backup and restore workflow overview showing site files and database being archived to cloud storage"

Step 1: Choose Your Backup Method

There are three practical routes for backing up a Joomla site. Pick based on how much manual work you're willing to do versus how much automation you want.

Method	How it works	Automation	Best for
Manual (FTP + phpMyAdmin)	Download all site files via FTP/SFTP, export the database via phpMyAdmin or `mysqldump`	None — fully manual	One-off backups, very small sites, learning how Joomla's file/DB structure works
Akeeba Backup	Joomla extension that packages files + database + a recovery script into a single archive (JPA, ZIP, or encrypted JPS)	CRON/CLI scheduling, pseudo-CRON URLs	Most Joomla sites — the de facto standard, free Core version covers most needs
Third-party backup/monitoring services	External services that connect to your site to pull scheduled backups and monitor uptime	Built-in scheduling and alerts	Agencies managing multiple sites who want backups stored fully outside the hosting account

💬 Why this guide focuses on Akeeba Backup

Akeeba Backup is free (GPL), actively maintained, and directly integrated into the Joomla extension ecosystem — it's the tool referenced in Joomla's own documentation and community guides. The steps below use it as the primary workflow, with the manual method as a fallback if you ever need a backup without installing anything.

Step 2: Install and Configure Akeeba Backup

Akeeba Backup is available as a free Core edition and a paid Professional edition (adds remote storage engines, encrypted JPS archives, and multi-part archive support) from the Joomla Extensions Directory or directly from Akeeba's site. As of mid-2026 it supports Joomla 3 through 6 and PHP 7.4 through 8.5, and can back up both MySQL/MariaDB and PostgreSQL databases.

In the Joomla backend, go to System → Manage → Extensions, upload the Akeeba Backup package, and install it.
Open Components → Akeeba Backup. On first run it launches the Configuration Wizard — accept the recommended defaults unless your host has specific PHP memory or execution-time limits.
Under Configure Backup → Basic Configuration, confirm the archive format (ZIP is the most portable; JPA is Akeeba's optimized native format; JPS adds AES-128 encryption on Professional).

🖼️ [SCREENSHOT NEEDED] Joomla admin, Components → Akeeba Backup → Configuration Wizard first-run screen, with the "Start the Wizard" button visible

Alt text: "Akeeba Backup Configuration Wizard first-run screen in Joomla administrator"

Step 3: Take Your First Full Backup

Go to Components → Akeeba Backup → Backup Now.
Add a description (e.g. "Pre-update backup — [date]") so you can identify it later in the Manage Backups list.
Click Backup Now and let the process complete. Do not close the tab until you see the "Backup completed successfully" confirmation.
Under Manage Backups, download the archive to your local computer as a first, immediate off-server copy.

⚠️ Don't stop at "backup created"

A backup that only exists on the same server as your live site is not a real safety net — if the server is compromised or the disk fails, the backup goes down with it. Step 4 covers sending it somewhere else.

Step 4: Send Backups Off-Server (Remote Storage)

Akeeba Backup can post-process each archive by uploading it automatically to remote storage right after the backup finishes. Supported destinations include Amazon S3 (and S3-compatible services), Dropbox, Google Drive, OneDrive, Box, Backblaze B2, and remote FTP/SFTP servers.

Go to Configure Backup → Post-processing Engine and select your storage provider.
Authenticate or enter the API credentials for that provider (each engine has its own setup screen with a "Test connection" option — always use it before relying on the profile).
Optionally enable Upload Kickstart with the backup so the restore script travels alongside the archive, making it easier to restore directly from remote storage later.

🖼️ [SCREENSHOT NEEDED] Akeeba Backup Configuration → Post-processing Engine dropdown, showing the list of remote storage options (S3, Dropbox, FTP, etc.)

Alt text: "Akeeba Backup post-processing engine settings showing remote storage provider options"

Step 5: Automate Backups with a Schedule

Manual backups only protect you if you remember to run them. Akeeba Backup supports scheduling through your host's CRON system or a command-line script.

In your hosting control panel, find the CRON Jobs section (naming varies by host).
Create a job that calls Akeeba's CLI backup script or its pseudo-CRON URL (found under Components → Akeeba Backup → Backup Now → Remote/CLI tab in the extension).
Set the frequency to match how often your content changes — daily for active sites with frequent posts/orders, weekly for mostly static sites.
Set a retention quota (how many backups to keep) so old archives don't silently fill your disk quota.

Step 6: Test the Restore — Before You Need It

A backup you have never restored is unverified. Testing on a staging copy or local environment is the single step most site owners skip, and the one that matters most when a real incident happens.

Set up a staging subdomain or local server (e.g. via Laragon or XAMPP).
Restore your latest backup there using the process in Step 7.
Confirm the site loads, admin login works, and content/database records are intact.

📱 [SCREENSHOT NEEDED] A restored test site loading correctly on a staging subdomain, browser address bar visible to confirm it's the staging URL, not the live domain

Alt text: "Joomla site successfully restored and loading on a staging subdomain for backup verification"

Step 7: Restore a Joomla Site from a Backup

Akeeba's restore process uses two components: Kickstart, a small standalone PHP script that extracts the archive, and ANGIE (Akeeba's automated restoration engine), which walks through reconfiguring the database connection and site settings. Together they let you restore without a fresh Joomla installation first.

Upload kickstart.php and your backup archive (.jpa/.zip/.jps) to the target site's root folder via FTP/SFTP.
Open https://yourdomain.com/kickstart.php in a browser.
Kickstart detects the archive automatically — select it and click Start to extract the files.
When extraction finishes, Kickstart hands off to ANGIE, which prompts for the database host, name, username, and password for the target server.
Follow ANGIE's steps to finish the site restoration, then verify the front end and admin login both work.

🖼️ [SCREENSHOT NEEDED] Kickstart.php restore screen in a browser, showing the detected backup archive and the "Start" button

Alt text: "Akeeba Kickstart restore screen showing detected Joomla backup archive ready for extraction"

📹 [VIDEO — OPTIONAL] Short screen-recorded walkthrough (3–5 min) of a full Kickstart + ANGIE restore from start to finish. Recommended because restore anxiety is the #1 reason site owners skip testing backups, and a real recording removes ambiguity a written guide can't.

Step 8: Clean Up After Restoring

⚠️ Required security step

After a successful restore, delete kickstart.php and the backup archive file from the server. Leaving either one publicly accessible lets anyone who finds the URL download your entire site and database — files, credentials, and all.

Common Mistakes to Avoid

⚠️ Mistakes that undermine backups

Storing backups only on the same server as the live site
Never actually testing a restore until an emergency forces it
Leaving kickstart.php or the archive file on the server after restoring
Skipping a backup right before a core or extension update
Letting old archives pile up with no retention quota, filling disk space silently

✅ What a solid setup looks like

At least one automated off-server copy on a schedule
A restore tested on staging at least once
Retention quota keeping only the backups you actually need
A manual backup taken before every core/extension update
Cleanup of restore scripts and archives after use

❓ Frequently Asked Questions

Does Joomla have a built-in backup feature?

No. Joomla's core does not include a native backup system, which is why a dedicated extension like Akeeba Backup or the manual FTP/database-export method is necessary.

How often should I back up my Joomla site?

Daily for sites with frequent content, orders, or user activity; weekly is usually enough for mostly static sites. Always take an extra manual backup right before a core or extension update.

What's the difference between Akeeba Backup Core and Professional?

Core (free) covers full site + database backups, local storage, and CLI/CRON scheduling. Professional adds more remote storage engines, encrypted JPS archives, multi-part archive splitting, and priority support.

Is it safe to keep backups only on the same hosting account?

No. If the server fails or is compromised, an on-server-only backup can be lost or corrupted along with the live site. At least one copy should live in separate remote storage.

Can I restore a Joomla backup to a different domain or host?

Yes. Kickstart and ANGIE are designed for this — you can restore the same archive to a new database, domain, or subfolder, which is also how Akeeba Backup is commonly used for site migrations.

What should I do immediately after restoring a site?

Delete kickstart.php and the backup archive from the server, then verify the front end, admin login, and any recent content or orders are intact.

➡️ What's Next

Once your backup and restore process is in place, the next priority is locking down the admin area itself — see our guide on how to protect the Joomla admin area.

✅ Last verified on Joomla 6.1.2 / 5.4.7, Akeeba Backup 10.3.6 — July 2026