What it does

For store owners who want a copy of their store outside the web server. The core Backup/Restore page keeps archives on the same server, so a disk failure, a hacked account or a closed hosting plan takes the backups too. Off-site Backup makes the database and files archives on a schedule, checks them, can encrypt them and uploads them to storage you own, in another data center.

How it works

Create a private bucket or an FTP folder, enter the endpoint and keys in the settings and press Test connection. Add the cron line from the dashboard. Each run makes the archive with the core backup engine, reads it to the end, encrypts it if you chose a password, uploads it (in parts for big files) and compares the remote copy. The dashboard lists archives with download and delete, and the run log shows every step.

Features

Separate schedules for database and files, at the hour you choose
S3-compatible storage: AWS S3, Backblaze B2, Wasabi, Cloudflare R2, DigitalOcean Spaces, MinIO
FTP and FTPS (explicit TLS) servers
Optional AES-256 encryption before the upload, decryptable with the openssl command
Size and MD5 checksum verification after every upload
Multipart upload for big archives, retries on network errors
Retention per type, local copies optional, never touches files it did not upload
Exclusions such as image thumbnails, extra folders on request
Dashboard with last backups, next runs, archives, download links and run log
Alerts for failed runs, overdue backups and a stopped cron
Command-line cron or a secret cron URL
Multi-Vendor and CS-Cart Ultimate, administrators only

What you get

Package	kv_offsite_backup-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support	12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License	1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

CS-Cart version and edition compatibility
CS-Cart version	CS-Cart	CS-Cart Ultimate	Multi-Vendor	Multi-Vendor Ultimate
4.22 and later	Testing next	Testing next	Testing next	Testing next
4.21.2	Supported	Supported	Supported	Supported
4.20.x	Supported	Supported	Supported	Supported
4.19.x	Supported	Supported	Supported	Supported
4.18.x	Supported	Supported	Supported	Supported
4.17.2	Tested	Supported	Supported	Supported
Before 4.17.2	Not supported	Not supported	Not supported	Not supported

Last tested build: CS-Cart 4.17.2, Nov 4, 2026Tested on: CS-Cart 4.17.2

Requirements

PHP	PHP cURL extension (S3-compatible storage) or the PHP FTP extension (FTP/FTPS). Both are standard on most CS-Cart hosting
PHP	PHP zip extension (ZIP archives) or Phar (TGZ archives)
Requirement	Free disk space for one archive in `var/backups` while it is made and uploaded (about the size of your database dump, or of the files archive)
Requirement	A command-line cron job, or a cron URL call for hosts without one
Core changes	None. Hooks and template overrides only

1.0.0

Nov 4, 2026

Latest

Added 9

Scheduled database backups (every 6 or 12 hours, daily, weekly) and files backups (daily, weekly, monthly) at a chosen hour, made with the core Backup/Restore engine (ZIP or TGZ); first backup at the next cron call, failed runs retried after one hour, missed days caught up.
Destinations: S3-compatible storage (AWS S3, Backblaze B2, Wasabi, Cloudflare R2, DigitalOcean Spaces, MinIO) with AWS Signature Version 4, multipart upload, Content-MD5 and retries; FTP and FTPS (explicit TLS).
Archive integrity check before the upload; size and MD5/ETag verification after it.
Optional AES-256-CBC encryption in the OpenSSL file format (PBKDF2-HMAC-SHA256, 100,000 rounds), decryptable with the openssl command.
Retention per type at the destination (only archives the add-on uploaded) and optional local copies.
Exclusions and extra paths for the files backup (thumbnails excluded by default).
Dashboard: last backups, next runs, archives with signed-link download, local download and delete, run log with every step and hashes, connection test, cron command and URL.
Admin alerts for failed runs, overdue backups and a stopped cron.
Console cron and key-protected cron URL; one run at a time.

Tested on CS-Cart 4.17.2. First release.

Does my hosting company not back up my store already?

Many do, often on the same infrastructure, with their own retention and restore terms. Off-site Backup keeps copies in storage you control, in another data center, on your schedule. Keep both.

Which storage should I use?

Any S3-compatible storage works: AWS S3, Backblaze B2, Wasabi, Cloudflare R2, DigitalOcean Spaces or your own MinIO. Pick a region away from your store's server. FTP/FTPS works with any backup server or NAS that offers it.

What does it cost?

The add-on has no subscription. Your storage provider bills you for the space and traffic of your own bucket; small stores often stay inside free or low tiers. Check your provider's prices.

How big are the archives?

The database archive is your SQL dump, compressed (typically a few MB to a few hundred MB). The files archive contains code, themes and images; thumbnails are excluded by default because the store recreates them.

Can it restore my store with one click?

No. Restoring overwrites live data, so it stays a manual, deliberate step. Usage lists the steps.

Is the backup encrypted?

Only if you turn on Encrypt archives. Then the archive is encrypted with AES-256 on your server before the upload, and the storage provider only holds unreadable files. Keep the password safe: there is no way to recover it.

Was it tested with real storage providers?

It was tested against local S3-compatible and FTP/FTPS test servers: signed requests (checked against the AWS Signature Version 4 examples), single and multipart uploads, checksums, retries, retention, encrypted archives, downloads and a database restore into an empty database. It was not tested against live AWS, Backblaze, Wasabi or Cloudflare accounts. Use Test connection after setup.

A backup failed. What now?

Open the run log: every step and the exact error are listed. Common causes: wrong keys or region (SignatureDoesNotMatch, AuthorizationHeaderMalformed), bucket name, firewall blocking outgoing FTP, PHP time limit on the cron URL (use the command-line cron), or not enough disk space for the archive.

Does it slow down the store?

Backups run from the cron or when you click a button, not during page views. Making the archive uses CPU and disk for a few seconds to minutes, so pick a quiet hour.

Multi-Vendor and CS-Cart (Ultimate)?

Both are supported. On Multi-Vendor, only administrators see the add-on, never vendors. On CS-Cart (Ultimate), one backup covers all storefronts; settings are global.