How to Backup a Joomla Website

Backing up a Joomla website means capturing both the site files and the database in a form you can restore on the same host or a new one. A usable backup is not a folder zip of images/ alone, and it is not a host snapshot you have never tested. For most Joomla 4, 5, and 6 sites the standard tool is Akeeba Backup (free Core or paid Professional), plus an off-site copy and a restore drill.

This is the complete Infyways runbook: strategy, what to include, Akeeba install and configuration, Backup Now, off-site storage, Kickstart restore, automation, and the mistakes that turn “we have a backup” into downtime.

What you will learn

What belongs in a real Joomla backup (and what you can safely exclude)
How Core and Professional Akeeba Backup differ for solo sites vs agencies
Step-by-step install, configure, Backup Now, download, and Kickstart restore
How to schedule backups, apply quotas, and keep archives off the public web root
When host backups, manual SQL dumps, and CLI jobs are better (or worse) than Akeeba

What a complete Joomla backup must include

Joomla stores content and settings in MySQL/MariaDB (or another supported DB). Templates, media, extensions, and configuration.php live on disk. Restore either piece alone and the site breaks.

Piece	Why it matters	Typical location
Database	Articles, users, menus, extension settings, SEF data	MySQL/MariaDB (prefix from `configuration.php`)
Site files	Core, templates, extensions, media, overrides	Document root (and sometimes private folders outside it)
`configuration.php`	DB credentials, paths, secret, mail, caching	Site root (rewritten during restore)
Restoration script	Lets you install the archive without a blank Joomla package	Embedded by Akeeba inside the archive

Optional but valuable: a written note of PHP version, Joomla version, and critical extensions. That context speeds recovery after a failed major upgrade.

Backup strategy before you click Backup Now

Tooling fails when strategy is missing. Use a simple policy every production site can follow.

3-2-1 rule: at least three copies, on two different media/systems, with one off-site (S3, Drive, another server, or downloaded to a machine that is not the web host).
Before every risky change: Joomla update, PHP bump, template change, migration, or security incident response.
On a schedule: daily or weekly depending on how often content changes. Ecommerce and membership sites usually need daily.
Test restore quarterly: a backup you have never restored is a hope, not a plan.
Retention: keep several generations (for example 7 daily + 4 weekly) so a bad backup does not overwrite the last good one.

Method	Best for	Limits
Akeeba Backup Core (free)	Most sites: one-click full backup, Kickstart restore/migrate	No cloud push, limited automation, no encrypted JPS
Akeeba Backup Professional	Agencies, shops, scheduled jobs, S3/Drive/SFTP, CLI	Paid subscription
Host panel backup / snapshot	Emergency host-level recovery	Often opaque; hard to move hosts; may exclude remote DBs
Manual files + phpMyAdmin dump	Tiny sites or one-off cloning	Easy to miss files; painful restore; no integrated installer
Server CLI (mysqldump + rsync/tar)	DevOps-managed VPS	You own scripting, encryption, and restore docs

Infyways recommendation for typical Joomla sites: Akeeba as the primary portable backup, host snapshots as a secondary safety net, and at least one copy downloaded or pushed off the origin server.

Step 1: Install Akeeba Backup

Download the current Akeeba Backup Core (or Professional) package from the official Akeeba product page. Match the package to your Joomla major version.
In the administrator go to System → Install → Extensions (wording varies slightly on Joomla 4/5/6).
Upload the package and confirm a clean install with no PHP fatal.
Open Components → Akeeba Backup. On first run, accept the configuration wizard / automatic configuration so Akeeba tunes itself to your server.

If installation fails on PHP version or memory, fix the server requirements first. Do not force an ancient Akeeba build onto a new Joomla release.

Step 2: Configure output directory and security

Open Akeeba Backup Configuration (profile settings).

Output directory: prefer a folder outside the public web root when the host allows it. If you must use a web-accessible path, use a random folder name and block HTTP access with .htaccess / server rules. Never leave dated .jpa / .zip files downloadable by the world.
Temporary directory: a writable temp path Akeeba can use during archival (often derived from site tmp). Confirm the folder is writable by PHP.
Archiver: JPA is the Akeeba-native format and usually the best default. ZIP is fine when you need wide tooling support. JPS (AES-encrypted) is a Professional feature for sensitive sites.
Database dump options: keep extended INSERTs enabled when your host supports them; include procedures/triggers if your extensions use them.

Save the profile. Create a second profile later if you need “files only” or “database only” jobs (Professional), or a lighter profile that excludes bulky cache folders.

Step 3: Set filters (exclude junk, keep what restores)

Default full-site backup is correct for disaster recovery. Trim noise so jobs finish and archives stay manageable:

Exclude cache directories that regenerate (cache/, template cache, image-cache plugins) unless you have a reason to keep them.
Exclude old backup archives inside the output folder so backups do not nest forever.
Exclude giant log directories and unused tmp dumps.
Do not exclude images/, template overrides, or extension folders you still use.

Professional adds regex filters, off-site directory includes, and extra database includes for multi-DB setups.

Step 4: Run Backup Now

Go to Components → Akeeba Backup → Backup Now.
Add a short description (for example pre-j5-upgrade-2026-09-17).
Start the backup and leave the browser tab open until it reports success. Do not navigate away on shared hosts with aggressive session limits; if the UI stalls, check Akeeba’s log and ALICE analyser rather than starting five parallel jobs.
Open Manage Backups / Administer Backup Files and confirm the archive size looks sane (not a few kilobytes).

If the job fails with timeout, memory, or “AJAX” errors, lower the partitioning size in Configuration, increase PHP max_execution_time / memory where allowed, or run during low traffic. Large media sites often need tuned chunk sizes more than they need a different product.

Step 5: Download and store a copy off the server

A backup that exists only on the same disk as the live site dies with the server.

Download the archive from Manage Backups, or pull it over SFTP.
Store it on encrypted disk, object storage, or another host.
With Professional, configure post-processing to Amazon S3, Google Drive, OneDrive, Dropbox, SFTP, or other supported remotes, then enable remote quotas so old cloud copies rotate.
Apply local quota rules so the web disk does not fill with archives.

Step 6: Restore with Kickstart (the correct way)

Do not treat an Akeeba archive like a random zip of a fresh Joomla package. Akeeba embeds a restoration script. The standard portable restore path:

Provision an empty directory (or clean target) on the destination server with a working PHP and a MySQL/MariaDB database ready.
Upload the backup archive (.jpa, .jps, or .zip) and the current Kickstart PHP file from Akeeba into that directory.
Browse to kickstart.php, extract the archive, then continue into the restoration (Angie) wizard.
Enter the new database credentials, site URL, and confirm configuration.php is written correctly.
Delete Kickstart and leftover installation / restoration files after a successful login.
Clear caches, recheck HTTPS, and test key pages (home, login, checkout, admin).

Professional can also restore some full-site archives from inside the component on the same site. Site Transfer Wizard helps move archives over FTP. For unattended restores, Akeeba UNiTE is the CLI path.

If you only have a host “files + SQL” dump without Akeeba’s restoration script, restore files, import SQL, then hand-edit configuration.php. That works, but it is slower and easier to get wrong than Kickstart.

Step 7: Automate (cron, Scheduled Tasks, CLI)

Manual Backup Now is perfect before upgrades. Production sites also need automation.

Professional: native CLI backup script, Joomla CLI integration (cli/joomla.php), Joomla Scheduled Tasks, front-end / remote backup API, and Remote CLI / UNiTE ecosystems.
Core: schedule is limited; many small sites download manually or rely on host jobs plus periodic Akeeba runs.
Always verify the first automated job actually produced a remote or downloaded file, not only a green UI message.

Step 8: Prove the backup with a restore drill

Quarterly (or after any major profile change):

Restore the latest archive to a staging subdomain or local environment.
Log into administrator, open a few articles, submit a contact form, and place a test order if you run ecommerce.
Note restore time. That number is your real RTO (recovery time objective).
Fix profile filters if something critical was missing.

Special cases

Before a Joomla or PHP upgrade

Take a named full backup, download it off-site, then upgrade. If the site white-screens, restore first and debug on staging. Pair this with our upgrade and security checklists when you move majors.

After a hack

Do not blindly restore an infected archive over a cleaned host. Prefer a known-clean backup from before the compromise, then patch and harden. See How to repair a hacked Joomla website.

Multisite / multiple databases

Core backs up the main Joomla DB. Professional can include extra MySQL databases and off-site directories when your architecture needs them.

Very large media libraries

Exclude regenerated caches, use JPA, tune part size, and consider storing bulky static media in object storage with a separate sync if archives become multi-gigabyte every night.

Security checklist for backup archives

Block web access to the output directory
Rotate and delete old archives with quotas
Prefer off-site copies for ransomware and host failure
Use JPS encryption (Professional) for sensitive data at rest when appropriate
Limit who can run Akeeba via Joomla ACL
Never commit backup archives to public git repositories

Key takeaways

A Joomla backup is files + database + a tested restore path, not a random zip of the template.
Akeeba Backup Core covers one-click backup and Kickstart migration; Professional adds cloud, scheduling, CLI, and encryption.
Store at least one copy off the production server and enforce quotas.
Restore with Kickstart (or Pro in-component restore), then delete installer tools.
Run a restore drill. Untested backups fail when you need them.

Frequently asked questions

What is the best way to backup a Joomla website?

Use Akeeba Backup for a portable full-site archive, keep a copy off-site, and test restore with Kickstart. Add host snapshots as a secondary layer.

Is Akeeba Backup free?

Akeeba Backup Core is free for standard backup and Kickstart restore. Professional is paid and adds cloud storage, automation, CLI, encrypted JPS, and more.

Does Akeeba work on Joomla 5 and Joomla 6?

Yes, when you install a current Akeeba package built for your Joomla major. Always download from Akeeba’s official site, not random mirrors.

Where should I store Joomla backup files?

Outside the public web root when possible, plus an off-site copy (S3, Drive, SFTP, or local encrypted disk). Never leave archives openly downloadable.

How often should I backup Joomla?

Before every upgrade or risky change, and on a schedule that matches content change rate. Daily is common for shops and membership sites; weekly may suffice for static brochure sites.

Can I restore an Akeeba backup like a new Joomla install zip?

No. Use Kickstart (or Professional’s restore tools) so the embedded restoration script can rewrite configuration and import the database correctly.

Are host cPanel backups enough?

They help in a host-side disaster but are a poor primary plan for moving hosts or granular recovery. Keep a portable Akeeba archive as well.

What if Backup Now fails halfway?

Read the Akeeba log, reduce part size / memory pressure, exclude huge cache folders, and retry. Do not assume a partial archive is restorable.

Can Infyways set this up for us?

Yes. We configure Akeeba profiles, off-site storage, and restore drills for Joomla sites. Contact Infyways for backup and maintenance help.