Almost every VPS offer says "backups included". Behind those two words there may be a nightly copy, stored off the machine and restored by experts, or a snapshot sitting on the same disk as the server. This guide gives the questions that make the difference, what each answer means, and how to check that a backup really restores.
By Simon Vasconcelos Lee
Published on 5 November 20268-minute read
| The question | Why it matters | The answer you want |
|---|---|---|
| What is backed up? | A backup of hand-picked files misses whatever nobody thought to include. | The whole server: OS, configuration, applications and data. |
| How often? | Everything changed since the last backup is lost when something fails. | Nightly at least, more often for a very busy database. |
| How long are backups kept? | An error or an intrusion is sometimes noticed days later. | Several restore points, over a period that covers the time to notice. |
| Where are they stored? | A copy on the same machine disappears with it. | Off the machine, on separate storage. |
| Are they encrypted? | A backup holds all your data, passwords and keys included. | Yes, before they leave the server. |
| Who restores? | A backup you cannot restore quickly is no help on the day of the failure. | Experts, on request. |
| Are restores included? | A restore billed separately tends to surface at the worst moment. | Yes, in writing in the offer. |
Two figures sum up a backup policy:
Retention answers a different question: how far back can you go? A deletion noticed the next day is fixed with the previous night’s backup. A quiet intrusion, silent corruption or a bug in an automated job may only surface later, and then you need a restore point from before the problem. For long-term archives, whether accounting or regulatory, a monthly export kept separately complements the server backup.
A backup protects against what happens to the server. So it has to live somewhere else:
One point often overlooked: a backup that can be deleted from the server can also be deleted by an intruder who has taken over the server. Backups made and kept by the host, out of reach of the server being backed up, avoid that risk.
A database writes all the time. A copy of its files taken while it runs captures it as it would be after a power cut: PostgreSQL and MySQL know how to recover from that state by replaying their log. For fine-grained restores, table by table or to another version, add a logical backup:
pg_dump -Fc -d my_db -f /backups/my_db-$(date +%F).dump
mysqldump --single-transaction --routines my_db | gzip > /backups/my_db-$(date +%F).sql.gzScheduled every night by a cron job, before the server backup runs, these exports end up inside it, and can also be copied to storage of your own.
The rule cybersecurity agencies recommend fits in three numbers: 3 copies of your data, on 2 different media, with 1 off-site. On a VPS it translates like this: live data on the server, the host’s backup off the machine, and a regular export of what matters most (the database, files uploaded by your users) to storage of your own.
restic -r sftp:user@storage.example.com:/backups init
restic -r sftp:user@storage.example.com:/backups backup /backupsA backup is proven by restoring it. Once a quarter, and after every significant change to the server:
On a managed VPS, these backups, keeping them off the machine and the restore itself are the host’s job: you ask, and the host restores.
If the server holds personal information, write the test down. Under PIPEDA, the federal private-sector privacy law, personal information must be protected by security safeguards appropriate to its sensitivity, against loss or theft as well as unauthorized access, disclosure, copying, use or modification. A dated restore test is the simplest way to show that the protection against loss holds up.
With a Simafri Managed VPS, your server is backed up every night, encrypted and stored off the machine, and restores are included, carried out by our team. Our experts run the server for you: updates, 24/7 monitoring with intervention before you even call, a dedicated contact and committed response times.
No. A disk mirror protects against a hardware failure, but it instantly copies a deletion, corruption or malicious encryption to the second disk. A backup is a separate copy, kept off the server, that you can go back to.
A snapshot on the same storage as the server lets you roll back quickly, after a failed update for example. It disappears with the storage it sits on: it complements a backup stored off the machine without replacing it.
Every night for the whole server, which limits the loss to one day at most. A database that records transactions all day benefits from adding continuous archiving of its log, which lets you go back to the minute.
It depends on the offer. On an unmanaged VPS, you are, unless the offer includes a backup. On a managed VPS, the host takes the backups and restores them. Either way, read what the offer says about frequency, retention, storage location and restores.
Simafri
Let's talk about your website
Tell us about your project in a few words: we will get back to you quickly.
Thank you! Your request has been sent. We'll get back to you shortly.
Prefer email? Write to us at support@simafri.com.