Configuration
Settings are in Add-ons > Manage add-ons > Off-site Backup > Settings. On CS-Cart (Ultimate) with several storefronts, the settings are global: open them with All storefronts selected. One backup covers the whole installation.
Schedule
Section titled “Schedule”| Setting | Default | What it does |
|---|---|---|
| Enable backups | On | Main switch. Off: no scheduled or manual backups. Archives at the destination stay. |
| Cron | Shows the cron command, the cron URL and the last cron call. | |
| Database backup | Daily | Off, every 6 hours, every 12 hours, daily or weekly. |
| Database backup hour | 03:00 | Daily and weekly backups run once per period at or after this hour (store time zone). |
| Files backup | Weekly | Off, daily, weekly or monthly (every 30 days). |
| Files backup hour | 04:00 | As above, for files. |
| Archive format | ZIP | ZIP or TGZ, the formats of the core Backup/Restore page. |
The first backup of a type runs at the next cron call after you turn it on. A failed scheduled backup is retried one hour later. A missed day (server down, cron stopped) is caught up at the next cron call.
Destination
Section titled “Destination”| Setting | What it does |
|---|---|
| Destination type | S3-compatible storage, FTP or FTPS (FTP with explicit TLS). |
| Endpoint | Empty for AWS S3. Otherwise your provider’s S3 endpoint. |
| Region | Bucket region (us-east-1, eu-central-1, us-west-004…). Cloudflare R2: auto. |
| Bucket | A private bucket only for backups. |
| Folder (key prefix) | Archives go to <prefix>/db/ and <prefix>/files/. Default cs-cart-backups. |
| Access key ID / Secret access key | Keys of a user that can only read, write and delete in this bucket. |
| URL style | Auto: virtual-hosted on AWS, path style elsewhere. Change only if your provider needs it. |
| FTP host, port, user, password | Your FTP server. Host without ftp://. |
| FTP folder | Created if missing. Archives go to <folder>/db/ and <folder>/files/. |
| Passive mode | On by default. |
Endpoint examples (check the exact one in your provider’s console):
| Provider | Endpoint | Region |
|---|---|---|
| AWS S3 | (empty) | your bucket region |
| Backblaze B2 | https://s3.<region>.backblazeb2.com |
e.g. us-west-004 |
| Wasabi | https://s3.<region>.wasabisys.com |
e.g. eu-central-1 |
| Cloudflare R2 | https://<account id>.r2.cloudflarestorage.com |
auto |
| DigitalOcean Spaces | https://<region>.digitaloceanspaces.com |
e.g. fra1 |
| MinIO | your MinIO URL | us-east-1 unless you changed it |
Use storage in another data center than your store. A backup on the same server is lost with the server.
FTPS encrypts the connection. PHP’s FTP extension does not check the server certificate; for the strongest protection also turn on archive encryption.
Content & retention
Section titled “Content & retention”| Setting | Default | What it does |
|---|---|---|
| Include images | On | The images folder (product, category, logo images). |
| Exclude paths | images/thumbnails |
One path per line, relative to the store root. var/cache, var/backups and var/upgrade are always excluded. |
| Extra paths | More files or folders, one per line. | |
| Keep database archives | 14 | Database archives kept at the destination. |
| Keep files archives | 4 | Files archives kept at the destination. |
| Keep local copies | 1 | Newest archives of each type kept in var/backups (0 = delete after the upload). |
The files backup contains app, design, js, var/themes_repository, var/snapshots, var/files, var/attachments, var/langs, the images (unless excluded), config.php, config.local.php, .htaccess, robots.txt and the PHP scripts in the store root. The database backup contains every table with your table prefix (structure and data).
Retention runs after each successful backup and deletes only archives that this add-on uploaded and recorded. Other files in the bucket or folder are never touched.
Encryption
Section titled “Encryption”| Setting | Default | What it does |
|---|---|---|
| Encrypt archives | Off | AES-256-CBC encryption on your server before the upload. |
| Encryption password | Key material (PBKDF2-HMAC-SHA256, 100,000 rounds, random salt per archive). |
Keep the password outside the store (a password manager). Without it nobody, including us, can open the archives. Changing the password does not re-encrypt older archives: keep the old one while they exist.
Decrypt a downloaded archive with OpenSSL 1.1.1 or newer:
openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -md sha256 -in store_db_20261104-030000.sql.zip.enc -out store_db_20261104-030000.sql.zipPermissions
Section titled “Permissions”The dashboard, downloads and the connection test need the Backup/Restore privilege (the same as the core Backup/Restore page). Multi-Vendor vendors never see the add-on.