Friday 5 p.m.: ransomware on the VPS. The team opens the host panel, "Automatic backups" section. Snapshots exist — but they were encrypted by the same root compromise, or deleted via API with the same credentials. One bin, one basket.
Included backups (snapshots, shared "D-7" backup) are useful to restore a file deleted by mistake or roll back before a failed update. They live in the same trust perimeter as production: same panel, often same backend storage, sometimes same region. An external copy breaks that correlation.
3-2-1 rule applied to the web
- 3 copies of data
- 2 media types (snapshot + object, block + logical tape)
- 1 off-site / off-account copy
| Scenario | Host backup alone | + External copy |
|---|---|---|
| File deleted by mistake | Often OK | OK |
| Silent DB corruption | Risk if snapshot corrupt too | Earlier restore point |
| Panel account compromised | Critical | Separate backup keys |
| Provider bankruptcy / closure | Critical | Recoverable export |
| Regional datacenter fire | Variable | OK if other region/provider |
Trusting the same provider to produce and protect your data is asking them to be judge and party.
What host backup usually covers
Shared hosting. Weekly shared backups, restore via ticket — slow, fuzzy scope.
VPS / cloud. Manual or automatic snapshots, sometimes paid managed backup. Retention 7 to 30 days.
Managed database. Built-in PITR backups — excellent within the product, still at the same provider.
Read exclusions: undumped databases, mail, some secondary volumes, dependency on proprietary agent.
Setting up external copy without over-engineering
Tools. restic, BorgBackup, rsync+SSH to another VPS, rclone to S3 bucket elsewhere.
Frequency. Files: daily incremental backup. Database: dump before sync + WAL if critical.
Encryption. Passphrase or GPG key stored off prod server (vault, team password manager, light HSM).
Retention. GFS (grandfather-father-son): 7 daily, 4 weekly, 12 monthly — adapted to your RPO.
Test. Quarterly script restoring to disposable VM and running HTTP smoke test + SQL query.
Many European hosts include snapshots; pair them with object storage on a different provider account for real separation — see our directory.
Mistakes that cancel external benefit
- Backup API keys stored on prod server
- "External" bucket but same cloud account
- Backups never tested — "we have the files" without mount
- Forgetting DNS, certificates, secrets and infrastructure-as-code config
The peak: included is not insurance
Decide and move forward without blind spots
First document business RPO and RTO — maximum acceptable loss and time to restore. Enable host snapshots for fast daily restores. Automate encrypted export to a second provider or another region. Plan quarterly restore test with a named owner. Related guides: restore proof, backup location. Compare hosts via the comparison tool.
Frequently asked questions
Is included host backup enough?
Rarely alone. It mainly protects against client error or local disk failure. It does not always cover malicious deletion, panel bug, provider bankruptcy or regional disaster if everything stays with the same actor.
What is an external copy concretely?
Encrypted export to a second provider, object bucket at another cloud, or off-site NAS with keys held by you. Essential: different account, jurisdiction or datacenter from production.
How often should you test restore?
At minimum quarterly on an isolated environment. A backup never restored is an unverified promise — many discover corruption at the worst moment.
Should you encrypt before external send?
Yes. Client-side encryption (restic, Borg, duplicity) with keys outside the host panel. Otherwise panel compromise exposes production and backups.
Next time a quote says "backups included", ask: can I restore at another host with these files alone? If the answer hesitates, you only have half a strategy.