Documentation / JustNow Remote Storage

Remote Storage and encryption

Sending backups encrypted to S3-compatible storage, Dropbox or Google Drive, and restoring from remote.

On this page
  1. Requirements
  2. S3-compatible storage
  3. Google Drive
  4. Dropbox
  5. Encryption
  6. Sending and retention
  7. Restoring a remote backup
  8. Decrypting without WordPress

Requirements

JustNow Backups must be installed with an active Pro license, and the Remote Storage add-on must be included in your license. The server needs PHP OpenSSL (AES-256-GCM) support. Menu: JustNow Backups → Remote Storage.

Keys, passwords and connection tokens are stored only on your own site, encrypted. Backup files go directly from your site to the storage; they never pass through the developer's server.

S3-compatible storage

Amazon S3, Cloudflare R2, Wasabi, Backblaze B2 (S3 API), DigitalOcean Spaces and MinIO are supported.

  1. Create a bucket in your provider's panel and generate an access key that can only write/list/delete in that bucket.
  2. Choose the provider on the Remote Storage page; the endpoint and addressing are filled with sample values.
  3. Enter the endpoint (without https://, e.g. s3.eu-central-1.amazonaws.com), region (auto for R2), bucket, access key and secret key.
  4. Click Save and test. If the test fails, switch the addressing option (path / subdomain) and try again.

Each site writes to its own subfolder (the domain) in the bucket, so several sites can safely share one bucket.

Google Drive

Ready connection (recommended)

  1. Choose Google Drive as storage and Ready connection as the method.
  2. Click Connect, sign in with your Google account and grant access. When you return to the page, the status shows Connected.

Backups are written to your own Google Drive. JustNow can only access the files it creates; it cannot see your other Drive files.

Your own Google app (advanced)

To use your own Google Cloud project, choose I will use my own Google app and follow the steps on the page: enable the Drive API, add only the drive.file scope on the consent screen, set the publishing status to In production, and create an OAuth client of type Web application with the redirect URI shown on the page added exactly.

“Testing” statusIf your own Google app is in “Testing” status, Google ends the connection after 7 days. Set the publishing status to “In production”.

Dropbox

  1. In the Dropbox App Console, click Create app: Scoped access, access type App folder.
  2. On the Permissions tab, tick files.metadata.read, files.content.read, files.content.write and account_info.read, then click Submit.
  3. On the Settings tab, add the address shown on the Remote Storage page to Redirect URIs.
  4. Enter the App key and App secret on the Remote Storage page, save, then click Connect.

Backups are written only to the Apps/<app name> folder in your Dropbox. An app in “development” status is enough for your own account.

Encryption

When Send backups encrypted is on, packages are encrypted with AES-256-GCM before sending (.zip.enc). The password must be at least 10 characters.

Do not lose the passwordIf you lose the password, encrypted backups cannot be opened or recovered; neither we nor your storage provider can open them. Keep the password in a safe place (e.g. a password manager). If you change the password, older backups still open with the old one.

Sending and retention

  • Manually: choose an existing package under Send local packages to remote storage and send it.
  • Automatically: add the Send to remote storage step to a backup task in the Scheduler.
  • Remote retention rule: in the Scheduler's Send to remote storage step, deletes older remote backups by count and age; the newest backup is always kept.

Restoring a remote backup

  1. In the backup list on the Remote Storage page, choose the backup and click Download and decrypt locally. If it is encrypted, enter the decryption password (leave it empty if it was encrypted with this site's saved password).
  2. The backup is added to Backup & Migration → Packages; install it from there with the normal Restore flow.

If the site was reinstalled or moved, choose the old site's folder in the list. Another site's backups can only be downloaded, not deleted.

Even after the license expiresyou can list, download and restore your existing remote backups. New uploads, settings changes and deletion are locked.

Decrypting without WordPress

If your site is completely unreachable, you can decrypt an encrypted backup on your computer. Use the tools/jn-decrypt.py file from the Remote Storage plugin:

pip install cryptography
python3 jn-decrypt.py backup.zip.enc backup.zip

The password is asked on the command line and is not shown on screen. Python 3.8 or later is required. You can then import the resulting backup.zip into a fresh WordPress and restore it.

← PreviousSchedulerNext →Uploading and publishing pages