VPS Hosting for Small Business: How to Decide If It's the Right Move

 

Most small businesses never think about their hosting until something goes wrong. The website is slow during a promotion. A developer asks for access to a setting the host won't change. The accounting software needs a server that staff can reach from home. Or a hosting sales page suggests you've "outgrown" your plan, and you're not sure whether that's true.

VPS hosting comes up in all of those conversations, usually described in technical terms that don't help an owner decide anything. This guide takes the opposite approach. It's written for owners and managers, not system administrators, and it focuses on the business decision: what a VPS does in plain language, what it can run beyond your website, who has to look after it, what it really costs, and when a different option is the smarter choice.

If you run a WordPress site or an online store specifically, our companion guides on VPS hosting for WordPress and VPS hosting for ecommerce go deeper on those setups. This one is about whether a VPS belongs in your business at all.

What VPS hosting means, without the jargon

Think of hosting as office space.

Shared hosting is a desk in a co-working space. It's affordable and someone else handles the building, but you share the internet, the kitchen and the meeting rooms. When the room gets busy, everyone slows down, and you can't rearrange the furniture.

A virtual private server (VPS) is a private office in the same building. The building is still shared, but your office has its own guaranteed space, its own lock, and you can set it up however you like. You're also responsible for what happens inside it.

A dedicated server is a whole building to yourself. It's the most powerful and the most expensive, and it comes with the most responsibility.

Managed hosting is any of these with a facilities team included. They keep things running so you don't have to, and you pay more for that.

In technical terms, a VPS is a virtual machine on a physical server, with its own guaranteed share of processing power, memory and storage, its own operating system, and full administrative access. Other customers on the same hardware can't see your data or use your share of resources.

Signs your small business may need a VPS

These are the situations where a VPS genuinely solves a problem. If none of them apply, you probably don't need one yet.

• Your website slows down or errors out at busy times. Shared hosting puts limits on each account. If your host reports that you're hitting them during campaigns or seasonal peaks, you've reached the ceiling of your plan.
• You need something your host won't allow. A specific software version, a background process, a custom application, or a setting your shared host keeps locked are all common reasons to move.
• You want to run more than a website. A VPS can host business applications, a remote desktop for staff, internal tools or a secure connection point for remote workers. Shared hosting can't.
• You manage several websites. Agencies and businesses with multiple brands often find one VPS simpler and more economical than several shared accounts, with each site kept separate.
• You need a fixed IP address. Some banks, payment portals, suppliers and government systems only accept connections from approved IP addresses. A VPS gives you your own address to register with them.
• Your clients or contracts ask where data lives. A VPS in a specific Canadian data centre gives you a clear, documentable answer about where your systems and data are hosted.

What a VPS can run besides your website

This is the part most hosting guides skip, and for small businesses it's often the deciding factor. A VPS is a general-purpose server. Your website can be one of several things it does.

Use	What it does for the business	Watch out for
Websites	Host your site, or several, with your own settings and resources	Same maintenance as any server
Business email	Run mailboxes on your own domain from your server	Running a mail server well is real work; many businesses use a dedicated email service instead
Remote desktop for Windows applications	Let staff use Windows software from anywhere through a Windows VPS	Microsoft and software-vendor licensing for remote users
Internal tools	Host a file-sharing system, wiki, project tracker, booking system or self-hosted CRM	Each application needs updates and backups
Secure remote access	Give staff an encrypted connection point and a fixed IP address for approved systems	Needs careful setup and access control
Testing and staging	Try website changes or new software safely before going live	Keep test copies of customer data protected

Two of these deserve a closer look, because they're where small businesses most often go wrong.

Business email on a VPS

You can run email on a VPS, and some control panels make it straightforward to set up mailboxes. The hard part is keeping it working well: making sure your messages land in inboxes rather than spam folders, filtering incoming spam and malware, handling storage, and recovering lost mail. That requires correct SPF, DKIM and DMARC records, reverse DNS for your server's IP address, and ongoing attention to your sending reputation.

For many small businesses, the better arrangement is to keep email with a dedicated email provider and use the VPS for the website and applications. If you do run email on the VPS, make sure someone owns deliverability and backups.

Remote desktop for Windows applications

A Windows VPS can let staff use Windows-only software from anywhere through Remote Desktop. That's useful for businesses whose accounting, practice-management or industry software only runs on Windows.

Two cautions before you set this up. First, licensing: Windows Server allows a small number of administrative remote sessions, but giving regular users remote desktop access generally requires additional Microsoft remote desktop licences, and many software vendors have their own rules about running their product on a hosted server. Check both before you migrate. Second, versions: make sure the Windows Server and SQL Server versions you're offered are still supported by Microsoft. Several older versions that still appear in hosting offers have reached, or are about to reach, the end of security updates.

Who runs the server? The decision that matters most

Every VPS needs someone to keep it secure and working. Here's what that job involves:

• Applying operating system and software security updates
• Configuring and maintaining the firewall
• Managing user accounts, passwords and remote access
• Setting up backups and checking that they restore
• Watching for errors, full disks and unusual activity
• Fixing problems, including outside business hours
• Renewing security certificates and licences

There are three realistic ways to cover that:

• You or someone on staff does it. That works if they have real Linux or Windows Server experience and time set aside for it. "Our office manager is good with computers" isn't enough.
• An IT provider or freelancer does it. Common for small businesses. Agree in writing what they'll do, how quickly they'll respond, and who has the passwords.
• Your host does it, through managed support. Most VPS providers offer support tiers that cover some or all of the job. Read the scope carefully; "managed" means very different things at different companies.

If you can't name the person or company responsible, you're not ready for a self-managed VPS. A neglected server is a security risk to your business and your customers.

What VPS hosting really costs a small business

The advertised price of a VPS is the starting point, not the total. A realistic monthly budget includes up to five parts:

Cost	What it covers	Notes
Base VPS plan	Processing power, memory, storage, bandwidth and an IP address	Compare the regular price, not just the introductory rate
Control panel licence	A point-and-click interface for sites, email and databases	Optional for technical users; most owners want one
Management	Updates, security, monitoring and support	Free only if your own time is free
Backups	Copies of your data you can restore from	Not always included; check carefully
Software licences	Windows remote desktop access, database licences, business applications	Often the biggest surprise on Windows servers

To make that concrete, here are monthly totals using 4GoodHosting's published Linux VPS prices in Canadian dollars, before tax, with monthly billing:

Setup	What's included	Monthly total (CAD)
Technical owner, self-managed	Startup plan (1 vCPU, 3 GB RAM, 40 GB)	$39.99
Owner wants a control panel and basic help	Startup + cPanel (1–5 accounts) + Tier 1 managed support	$94.94
Owner wants the server looked after, with backups	Startup + cPanel (1–5 accounts) + Tier 3 managed support with backups	$134.94
Growing business, several sites, fully supported	Enterprise (2 vCPU, 4 GB RAM, 60 GB) + cPanel + Tier 3 managed support	$144.94

Longer prepaid terms reduce the base VPS price for the first term only; renewals use the regular rate, and add-ons keep their own prices.

There's one more cost no price list includes: your time. If a self-managed server takes a few hours a month of an owner's or employee's attention, plus the occasional evening when something breaks, that time has a value. Compare it honestly with the price of managed support before deciding the cheaper plan is cheaper.

When a VPS isn't the right move

A VPS solves specific problems. These situations usually call for something else.

• Your site is a simple brochure site with modest traffic. Good shared hosting handles this well, costs less and needs no server management.
• You want WordPress to be faster but don't want a server. Managed WordPress hosting gives you a tuned environment without root access or maintenance.
• Your store runs on a hosted ecommerce platform. The platform runs the servers. A VPS adds nothing for the store itself.
• The real problem is the website, not the hosting. Slow pages are often caused by large images, heavy plugins or no caching. Fix those first; a bigger server won't.
• Your business tools are available as online services. If your accounting, CRM or file sharing is available as a subscription service that handles its own hosting, that's often simpler than running it yourself, unless you have a specific reason to self-host, such as data location, customization or cost at scale.
• Nobody will look after it. This one overrides the rest.

A five-question decision guide

Answer these in order. They'll point you to the right option faster than a spec sheet.

1. What needs to run? If it's only a simple website, shared or managed hosting is usually enough. If it's a busy site, several sites, or business applications, keep going.
2. Does it need anything shared hosting won't allow? Custom software, background processes, remote desktop or a fixed IP address all point to a VPS.
3. Who will manage it? If you can name a qualified person or are willing to pay for managed support, a VPS is viable. If not, choose managed hosting.
4. What's the full monthly cost? Add the plan, control panel, management, backups and licences. Compare that total, not the base price, with your alternatives.
5. Where must your data live? If clients, contracts or regulators expect Canadian hosting, choose a provider and data centre that let you document it.

If you reach the end with a clear yes on the first two and a named owner for the third, a VPS is likely the right move.

Three small businesses, three different answers

These scenarios are illustrative, but they reflect the situations owners describe most often. Each one works through the decision guide above.

A landscaping company with a brochure website. The site has a dozen pages, a contact form and a photo gallery, and traffic rises a little in spring. Nothing about it needs custom software, background processes or a fixed IP address, and nobody on the team manages servers. The right move is to stay on good shared hosting, or move to managed WordPress hosting if the site is slow. A VPS would cost more, add a maintenance job and change nothing a customer would notice.

An accounting practice with Windows-only software. Six staff need the practice's desktop accounting and tax software from home and from client offices. The software only runs on Windows, and client files must stay in Canada. Here a Windows VPS hosted in a Canadian data centre is a genuine option: staff connect through Remote Desktop, and the files never leave the server. The checks that matter are licensing for six remote users, the software vendor's rules on hosted use, a supported Windows Server version, and a managed support arrangement, because nobody in the practice will patch a server. The alternative worth pricing is whether the vendor offers a cloud edition that removes the server entirely.

A small web agency hosting client sites. The agency builds and maintains a dozen client WordPress sites, currently spread across several shared accounts with different logins and renewal dates. A Linux VPS with a control panel licensed for multiple accounts lets it host every client separately on one server, standardize updates and backups, and bill hosting as part of its maintenance retainer. The agency has a developer comfortable with Linux, so self-managed works, though Tier 3 support can cover holidays and emergencies. The main risk is concentration: one server now carries every client, so backups, monitoring and a tested restore plan become part of the agency's service.

The same five questions produced three different answers. That's the point: the right hosting depends on what the business needs to run and who will look after it, not on which option sounds most capable.

Security basics for a small business server

You don't need to become a security expert, but you do need to make sure these basics are in place, whether you do them yourself or confirm your provider does.

• Strong, unique passwords and multi-factor authentication on every account that can reach the server, the hosting account and the control panel.
• Key-based login for administrators, with password login disabled for the main administrative account.
• A firewall that only allows the connections you actually use.
• Automatic security updates for the operating system, plus a schedule for updating applications.
• Backups stored somewhere other than the server, tested by actually restoring them.
• Remove what you don't use: old user accounts, test sites, unused software and former staff access.
• A short written plan for what to do if something goes wrong: who to call, where backups are, and how to tell customers if their information is affected.

The Canadian Centre for Cyber Security publishes practical baseline controls for small and medium organizations. They're a useful checklist to share with whoever manages your server.

Moving to a VPS without disrupting the business

A careful move is mostly about preparation. Most problems come from something nobody remembered was running on the old hosting.

1. Take an inventory. List every website, email account, scheduled task, database, form, SSL certificate and third-party connection on your current hosting. Note where your domain's DNS is managed and who has the login.
2. Decide where email will live before anything else moves. Email is the service staff and customers notice first if it breaks.
3. Build and secure the new server first, including backups and the firewall, before any data arrives.
4. Copy and test. Move one site or application at a time and test it on the new server before switching anything live.
5. Lower your DNS time-to-live a day or two before switching, so changes take effect quickly.
6. Switch during a quiet period and tell staff what to expect, including any new login steps.
7. Watch closely for a few days: contact forms, order and invoice emails, scheduled tasks and remote access are the usual trouble spots.
8. Keep the old hosting for a week or two in case you need to roll back, then cancel it and remove old copies of customer data.

If you'd rather not do this yourself, ask your new provider what migration help is included and what it covers.

Canadian considerations for small business hosting

Privacy law applies to small businesses too. PIPEDA applies to private-sector organizations that collect personal information in the course of commercial activity, in provinces without their own substantially similar private-sector law. If your website, email or applications hold customer information, you're responsible for protecting it, and that includes the server it lives on. Breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and to the people affected.

Hosting in Canada makes data location easy to explain. PIPEDA doesn't require data to stay in Canada, but you're accountable for information you send to providers elsewhere. Hosting in a Canadian data centre keeps that explanation simple, and some clients and contracts ask for it outright.

Quebec has stricter rules. If you hold personal information about Quebec residents, Law 25 adds obligations, including a privacy assessment before that information is communicated outside Quebec, which commentators note includes other provinces. Hosting in Toronto or Vancouver doesn't remove that step.

Some sectors have their own expectations. Professional regulators, health-sector rules, government contracts and some insurers have their own requirements about where and how client information is stored. If you work in a regulated field, check before you move systems.

Local support and local billing. A Canadian provider bills in Canadian dollars, which removes exchange-rate surprises, and works in your time zones when something needs fixing.

Questions to ask any VPS provider before you buy

Whichever provider you choose, these questions separate a clear offer from a vague one:

Question	Why it matters
What's the regular price after the first term, and which add-ons don't get the discount?	Renewal pricing is what you'll pay for most of the server's life
What exactly does managed support cover, and how quickly do you respond?	"Managed" means very different things at different providers
Are backups included, how often do they run, where are they stored and how do I restore?	Backups are the most commonly misunderstood part of a hosting plan
Which data centre will my server be in?	Matters for speed and for documenting where data lives
Which operating system and software versions are offered, and are they still supported?	Unsupported versions stop receiving security fixes
How do I add memory or storage later, and is there downtime?	Small businesses grow in steps; upgrades should be simple
What help do you provide with migration?	Moving email and sites is where most problems happen
Can I cancel, and what happens to my data if I do?	You should be able to leave with your data intact

A good provider will answer every one of these plainly and in writing.

Where 4GoodHosting's VPS hosting fits

4GoodHosting's VPS hosting runs from data centres in Vancouver and Toronto, so you can place your server on the side of the country where most of your customers and staff are. It offers both Linux and Windows VPS hosting plans.

The Linux VPS hosting plans run from the Startup plan (1 vCPU, 3 GB of RAM, 40 GB of storage) at $39.99 CAD a month to the Platinum plan (5 vCPU, 8 GB of RAM, 200 GB) at $169.00 CAD a month, at regular monthly rates before tax. Each includes full administrative access, 10 TB of monthly transfer, one IP address, RAID 10 storage, 24-hour monitoring and Canadian support. The base plans are self-managed; a cPanel control panel and Tier 1 or Tier 3 managed support are available as add-ons, and Tier 3 includes 50 GB of onsite backups.

Windows VPS hosting plans include remote desktop access, which is what makes them useful for Windows-only business software. Confirm current Windows plan pricing, the Windows Server version, and remote desktop licensing for your number of users with the sales team before ordering.

4GoodHosting also offers a free website transfer service for moving an existing site, and a 30-day money-back guarantee under its service terms. If you're unsure whether a VPS is the right step, its support team can also talk through whether shared or managed WordPress hosting would suit you better.

When you've outgrown a VPS

A VPS isn't the last step, and it helps to know what the next one looks like before you need it.

• You keep upgrading and still run short. If you've moved up several plan sizes and memory or processing power is still the bottleneck at busy times, a dedicated server gives you a whole machine with no neighbours, usually at a better price per unit of power than the largest virtual plans.
• One server has become a single point of failure. When the website, applications and remote access all depend on one server, an outage stops the whole business. At that point it's worth separating services, for example moving email to a dedicated provider, putting the website and the internal applications on separate servers, or adding a standby server you can switch to.
• Compliance or client requirements tighten. Larger clients, insurers and regulated sectors sometimes ask for documented controls, audit logs, isolation or recovery testing that are easier to provide with a more formal setup and a managed provider.
• Your IT needs have grown into a job. If managing servers takes a meaningful share of someone's week, it may be time for a dedicated IT provider, a fully managed arrangement, or moving some systems to online services that handle their own infrastructure.

None of these is a reason to skip a VPS today. They're signals to watch for as the business grows, so the next decision is planned rather than forced by an outage.

Common mistakes small businesses make with VPS hosting

• Buying a VPS because a sales page said you'd outgrown shared hosting, without checking whether you're actually hitting limits.
• Choosing self-managed to save money, then having no one to apply security updates.
• Comparing introductory prices instead of regular renewal prices and full monthly totals.
• Assuming backups are included. Check what's backed up, how often, where it's stored and how to restore it.
• Running business email on the server without owning deliverability, then wondering why invoices land in spam.
• Moving Windows software without checking licensing, then discovering remote users need extra licences.
• Accepting an out-of-support Windows Server or SQL Server version because it's what was offered.
• Keeping all the passwords with one person, usually a former contractor.
• Never testing a restore until the day it's needed.

Small business VPS checklist

Before you decide

• Confirmed what the server needs to run: website, email, applications or remote access
• Confirmed shared or managed hosting can't do the job
• Named the person or company responsible for managing the server
• Calculated the full monthly cost, including control panel, management, backups and licences
• Checked whether clients, contracts or regulators require Canadian hosting

Before you move

• Checked software licensing for hosted and remote use
• Confirmed Windows Server and SQL Server versions are still supported, if applicable
• Decided where business email will live
• Arranged offsite backups and planned a test restore
• Recorded all logins in a shared password manager the business controls

After you move

• Multi-factor authentication on hosting, control panel and server accounts
• Firewall and automatic security updates confirmed
• First backup restore tested
• Incident plan written down, including privacy breach steps
• Review date set to check resources and costs after three months

FAQ

Is VPS hosting good for a small business?

VPS hosting for small business is a good fit when a business has outgrown shared hosting, needs software or settings shared hosting won't allow, or wants one server to run its website alongside business tools such as remote desktop applications. It's a poor fit if nobody will manage the server and the business isn't paying for managed support.

How much does VPS hosting cost for a small business in Canada?

Entry-level Linux VPS plans from Canadian providers often start in the tens of dollars a month. 4GoodHosting's Linux VPS plans ranged from $39.99 to $169.00 CAD a month at regular rates in October 2026, before tax. Adding a control panel and managed support with backups typically brings a small setup to roughly $95 to $145 CAD a month.

Do I need technical skills to use a VPS?

To manage a VPS yourself, yes: you or someone on staff needs real experience with Linux or Windows Server administration, security updates and backups. If you don't have those skills, choose a plan with managed support, hire an IT provider, or consider managed hosting, which handles the server for you.

What's the difference between shared hosting and a VPS?

Shared hosting places many customers on one server with shared resources and the host's fixed settings. A VPS gives your business its own guaranteed share of processing power, memory and storage, its own operating system and full administrative control. The trade-off is that a VPS needs someone to maintain it.

Can I run business email on a VPS?

Yes, but running email well takes ongoing work: setting up SPF, DKIM, DMARC and reverse DNS, filtering spam and malware, and protecting your sending reputation so messages reach inboxes. Many small businesses keep email with a dedicated email provider and use the VPS for websites and applications.

Can staff use Windows software remotely through a VPS?

Yes, through a Windows VPS with Remote Desktop. Check licensing first: regular users generally need additional Microsoft remote desktop licences, and some software vendors restrict running their products on hosted servers. Also confirm the Windows Server and SQL Server versions offered are still supported by Microsoft.

What does 4GoodHosting's VPS hosting include?

4GoodHosting's Linux VPS plans include full administrative access, 10 TB of monthly transfer, one IP address, RAID 10 storage, 24-hour monitoring and Canadian support, hosted in Vancouver or Toronto. A cPanel control panel and managed support tiers are optional add-ons. Windows VPS plans add remote desktop access for Windows applications.

When should a small business choose managed hosting instead of a VPS?

Choose managed hosting when your main need is a fast, reliable website and you don't need custom software, background processes or remote desktop access. Managed hosting handles updates and maintenance for you, which suits businesses without IT staff. A VPS makes more sense when you need control or want to run more than a website.

Does hosting in Canada matter for a small business?

It can. Hosting in a Canadian data centre makes it simple to explain where customer data lives, which some clients and contracts require. PIPEDA doesn't require Canadian data residency, but you remain accountable for information sent elsewhere. Quebec's Law 25 adds an assessment step before personal information leaves Quebec.

Key Takeaways

• VPS hosting for small business makes sense when you've outgrown shared hosting, need software shared hosting won't allow, or want to run business tools alongside your website.
• A VPS can host websites, email, remote desktop applications, internal tools, secure remote access and staging environments.
• The most important decision is who manages the server. If you can't name someone, choose managed support or managed hosting.
• Budget for the full monthly cost: base plan, control panel, management, backups and software licences.
• 4GoodHosting's Linux VPS hosting plans ranged from $39.99 to $169.00 CAD a month at regular rates in October 2026; a supported small setup runs roughly $95 to $145.
• Business email on a VPS needs someone to own deliverability; many businesses keep email with a dedicated provider.
• Windows remote desktop use needs licensing checks and supported Windows Server and SQL Server versions.
• PIPEDA applies to small businesses; Canadian hosting simplifies data-location questions, and Law 25 adds steps for Quebec data.

Conclusion

For a small business, VPS hosting isn't a status upgrade. It's a tool that does three things well: gives a busy website dependable resources, lets you run software and settings shared hosting won't allow, and lets one server handle the website and the business systems around it.

Whether it's the right move depends far less on processor counts and storage types than on three plain questions. What do you need it to run? Who will look after it? And what will it really cost each month once management, backups and licences are counted? If you have clear answers to all three, a VPS can be one of the most useful pieces of infrastructure a small business owns. If you don't, a managed option will serve you better until you do.

Either way, make the decision on your business's needs rather than a sales page's definition of "outgrown". That's the move that's always right.

Ready to find the right hosting plan?

Not sure whether your business needs a VPS, or just a better hosting plan? Talk to 4GoodHosting's Canadian support team. Tell us what your website and business systems need to do, and we'll help you compare shared hosting, managed WordPress hosting and 4GoodHosting's VPS hosting, including the management and backups that fit your team.

Compare 4GoodHosting's VPS hosting plans →
Call 1 866 708 4678 · 24/7 support

VPS Hosting for eCommerce: When Your Online Store Needs It and How to Run It Well

Short Answer

VPS hosting for ecommerce makes sense when a self-hosted store, such as WooCommerce, Magento or PrestaShop, needs reliable resources for the pages that can’t be cached: cart, checkout and customer accounts. It also gives you the control to run an object cache, background workers and a properly tuned database. It doesn’t make you PCI compliant, and it doesn’t run itself. Keep card data off your server, size for peak checkouts rather than average visitors, back up order data far more often than nightly, and decide up front who will manage the server.

A content website and an online store can look identical on the surface. Underneath, they behave very differently. A blog serves the same pages to almost everyone, so caching does most of the work. A store spends its most valuable moments doing things no cache can help with: building a cart for one person, checking stock, calculating tax and shipping, talking to a payment gateway, writing an order, and sending a confirmation email, all within a few seconds while the customer waits.

That’s why stores tend to outgrow shared hosting earlier than other sites, and why VPS hosting comes up so often once a store starts doing real volume. But the decision involves more than performance. Payment security, backups of order data, peak-day planning, email deliverability and Canadian privacy rules all change once you’re running your own server.

This guide covers all of it from a store owner’s point of view. It explains when a store genuinely needs a VPS and when it doesn’t, what changes for checkout, how VPS hosting relates to PCI DSS (including the 2025 changes for ecommerce merchants), how to prepare for Black Friday and Boxing Day, and what Canadian stores need to handle differently. It finishes with how 4GoodHosting’s VPS hosting fits a typical store, with real costs.

Why Online Stores Are Harder to Host Than Ordinary Websites

Five things make ecommerce workloads different.

The pages that matter most can’t be cached. Product and category pages can usually be cached for anonymous visitors. Cart, checkout and account pages can’t, because they’re different for every customer. Every one of those requests runs PHP and queries the database.

Stores write data constantly. Carts, sessions, stock levels, orders, customer records and logs all change as people shop. Writes are harder to scale than reads, and they’re where slow servers show up first during busy periods.

Background work never stops. WooCommerce uses a queue called Action Scheduler for tasks such as order emails, webhooks, subscription renewals and data syncs. Magento and other platforms have their own cron and queue systems. When the server is short of resources, this work falls behind quietly.

Traffic is spiky. A promotion, an email campaign or a holiday weekend can multiply traffic in minutes. Shared hosting limits that are fine on an ordinary Tuesday can fail during the hours that make your quarter.

Every failure costs money directly. When a content site is slow, readers leave. When a checkout fails, the sale is gone and the customer may not come back.

Does Your Store Need VPS Hosting at All?

Start with your platform, because it decides whether hosting is your problem at all.

Hosted ecommerce platforms run the servers for you. Your monthly subscription covers hosting, scaling and much of the security work. If your store runs on one of these, you don’t need a VPS for the store itself.

Self-hosted platforms, such as WooCommerce, Magento Open Source, PrestaShop and OpenCart, run on hosting you choose. That’s where the choice between shared hosting, managed hosting, a VPS or a dedicated server applies.

Hosting option	Fits a store that…	Watch out for
Shared hosting	Has modest, steady traffic and a small catalogue	Per-account limits during sales; little control over caching and background jobs
Managed WordPress hosting	Runs WooCommerce and wants performance without server work	Less control; check plugin restrictions and how uncached traffic is handled
VPS	Needs dependable resources, custom software or several stores on one server	Someone must run the server, or you pay for managed support
Dedicated server	Has heavy, sustained load or strict isolation needs	Higher cost and the same management question at larger scale

If you’re on WooCommerce and don’t want to manage a server, managed WordPress hosting is worth comparing before you commit to a VPS.

Signs Your Store Has Outgrown Shared Hosting

These are the store-specific symptoms. Most can be checked from your admin area or your host’s control panel.

• Checkout slows down during promotions, even though product pages stay fast. That’s uncached capacity running out.
• Your host reports resource limits on CPU, memory or processes during busy periods, or customers see errors at checkout.
• Scheduled actions pile up. In WooCommerce, check Status → Scheduled Actions for a growing list of past-due tasks. Delayed order emails and failed syncs often start here.
• Payment or shipping webhooks time out. Gateways and carriers send notifications to your store; if the server is too slow to respond, orders can be left in the wrong status.
• Order and product screens in the admin are slow. Staff processing orders feel server capacity before customers do.
• Inventory sync with a point-of-sale system or marketplace fails or runs late, causing overselling.
• You need software your host won’t allow, such as Redis, a dedicated search service, a queue worker or a specific PHP extension.

Two or three of these together usually justify a move. One on its own may be a configuration problem worth fixing first, which the sections below cover.

When a Slow Store Doesn’t Need a Bigger Server

Before paying for more hosting, rule out the store-specific causes that make checkout slow on any server:

• Product and category pages aren’t cached. Many stores cache nothing because a plugin or theme sets cookies on every page. If anonymous visitors can’t get cached pages, the server does far more work than it needs to.
• Cart fragments on every page. Some themes refresh the mini-cart with an extra uncached request on every page view, even for visitors who never add anything. Limiting that to pages that need it can remove a large share of uncached traffic.
• Too many checkout plugins. Each extra field, upsell, tracking script or address-validation tool adds work to the slowest page in the store. Audit what runs at checkout and remove what isn’t earning its place.
• Slow external services. Tax calculation, shipping-rate lookups and fraud checks often call outside APIs during checkout. If one of them is slow, checkout is slow, and no server upgrade will fix it.
• An oversized options table or order history. Years of expired transients, abandoned carts and old logs slow database queries. Cleaning them up and moving to High-Performance Order Storage can help on any hosting.
• Old PHP. A store still on an end-of-life PHP release is slower and less secure than it needs to be.

If you fix these and checkout still slows during busy periods, you’ve confirmed the problem is capacity, and a VPS is the right next step.

What VPS Hosting Changes for an Online Store

A virtual private server gives your store its own allocation of CPU, memory and storage on shared physical hardware, plus root access to configure it. For ecommerce, that translates into five practical gains.

Predictable checkout capacity. Your memory and CPU allocation isn’t used by other customers’ sites, so a neighbour’s traffic spike won’t slow your checkout.

A tuned stack. You can add Redis as an object cache, size the database’s memory properly, run PHP’s worker pool to suit your traffic, and move sessions into memory. These make the biggest difference to uncacheable pages.

Reliable background processing. You can run WooCommerce’s Action Scheduler or Magento’s cron from a real system scheduler, and run queue workers continuously instead of waiting for page visits to trigger them.

Room for modern data structures. WooCommerce’s High-Performance Order Storage, enabled by default for new stores since version 8.2, moves orders into dedicated database tables with their own indexes. It reduces database contention, and on a VPS you can give that database the memory it needs.

Staging and isolation. You can run a staging copy of the store for testing updates, and, if you run several stores, keep each under its own system user and database so a problem in one can’t reach the others.

What it doesn’t change is responsibility. On a self-managed VPS, patches, security, backups and monitoring are yours. That’s the most important thing to decide before buying.

Payments and PCI DSS: What Hosting Does and Doesn’t Change

The Payment Card Industry Data Security Standard (PCI DSS) applies to every business that accepts card payments. Moving to a VPS doesn’t make a store compliant or non-compliant on its own. What matters is how your payment flow is built, because that decides how much of your environment is “in scope”.

Payment setup	Typical self-assessment questionnaire	What it means for your server
Customer is redirected to the payment provider, or card fields load in the provider’s iframe	SAQ A	Card data never touches your server; scope is smallest, but your payment page still matters
Your site serves the payment page but the provider receives the card data directly, for example through a direct post or JavaScript form	SAQ A-EP	Your web server can affect card data security, so it’s in scope
Card data passes through or is stored on your server	SAQ D	Your server is fully in scope, with a much larger set of requirements

For almost every small and mid-size store, the right answer is to keep card data off your server entirely by using your payment provider’s hosted page or embedded fields. That keeps your scope as small as it can be.

The 2025 Change Every Ecommerce Merchant Should Know

PCI DSS version 4 introduced two requirements aimed at e-skimming, where attackers inject malicious scripts into payment pages to steal card details: managing the scripts that run on payment pages (6.4.3), and detecting unauthorized changes to them (11.6.1). In January 2025, the PCI Security Standards Council revised SAQ A to remove those two requirements as line items, and added an eligibility criterion instead. Merchants using SAQ A must now confirm their site isn’t susceptible to script attacks that could affect their e-commerce systems.

In plain terms: if the page that hosts your provider’s payment iframe can be tampered with, the iframe alone doesn’t make you safe. On a VPS, you control the server that delivers that page, which helps, but only if you lock it down.

What a Host Can and Can’t Do for You

A host can secure the infrastructure, run vulnerability scans, harden the server and help document controls. It can’t complete your self-assessment questionnaire, and passing a vulnerability scan isn’t the same as being PCI compliant. Compliance covers your payment flow, your application, your staff practices and your policies as well as the server.

4GoodHosting offers a separate PCI compliance service, including an initial assessment. Confirm its scope, and confirm your obligations with your payment provider or acquirer, which decides how you validate compliance.

Securing an Ecommerce VPS

The basic server hardening any VPS needs applies here: SSH keys, a firewall, automatic security updates and least-privilege accounts. Stores need more on top.

• Protect the payment page. Load as few third-party scripts on checkout as possible. Use a Content Security Policy to restrict which scripts may run, and Subresource Integrity for scripts you load from other domains.
• Lock down the admin. Require two-factor authentication for every admin and shop-manager account, and consider restricting the admin area by IP address or VPN.
• Run a web application firewall. A WAF blocks common attacks, including credential stuffing and injection attempts, before they reach your store.
• Watch for file changes. File integrity monitoring alerts you when core files, plugins or theme files change unexpectedly, which is often the first sign of a compromise.
• Patch on a schedule. Ecommerce plugins and extensions are frequent targets. Test updates on staging, then apply them promptly in production.
• Keep logs and keep them away from the server. Ship access and error logs somewhere an attacker on the server can’t delete them.
• Separate staging from production. Staging copies of a store contain real customer data unless you anonymize them. Protect staging like production, or scrub the data.

If nobody on your team will do this work consistently, budget for managed support or a security service. An unpatched store is a greater risk on a VPS than on managed hosting, because the server’s security is now in your hands.

Planning for Peak Days: Black Friday, Cyber Monday and Boxing Day

Canadian retailers have a busy stretch from late November through Boxing Day. On a VPS, you can prepare for it properly instead of hoping your plan copes.

• Measure a normal baseline in October: memory use, CPU load, PHP worker queue, database load and checkout response time during your busiest ordinary hours.
• Load test a staging copy. Simulate browsing plus a realistic share of add-to-cart and checkout steps, using test payment mode, and find the point where response times climb.
• Scale before you need to. If testing shows you’ll run short, add memory or move up a plan in advance. Resource changes may need support involvement and planning, so don’t leave them to the morning of the sale.
• Warm your caches after any deployment or restart, so the first wave of customers isn’t building the cache.
• Freeze changes for the peak window: no plugin updates, theme changes or new integrations unless they fix a live problem.
• Move heavy jobs out of the way. Reschedule backups, imports, feed generation and reindexing outside peak hours.
• Check your payment and shipping integrations, including any rate limits on their APIs and whether webhooks are reaching your store.
• Watch it live. Have someone monitoring checkout, error logs and the scheduled-actions queue during the peak, with a clear plan for who to call.
• Review afterwards. Record what you saw at the peak, and use it to decide whether to scale back down or stay on the larger plan.

Sizing a VPS for a Store

Size a store by its uncacheable traffic, not its total visitors. The useful questions are how many people will be in their cart or checkout at the same moment at your busiest time, how many staff and customers will be logged in, and how large your database is.

Memory is usually the limit. The operating system, the database, an object cache and every PHP worker each need a share, and each simultaneous checkout needs a worker. Measure memory per PHP worker on your current store, work out how many workers your peak needs, and size from there.

As a starting point to test, these are reasonable allocations for common store types:

Store type	Starting allocation	Why
Small catalogue, steady traffic, one store	2 vCPU, 4 GB RAM	Room for uncached cart and checkout alongside caching
Growing store with regular promotions	3 vCPU, 5 GB RAM	Headroom for traffic spikes and more background work
Large catalogue, subscriptions or memberships	4 vCPU, 6 GB RAM	More logged-in users and heavier database queries
Several stores, or a high-volume single store	5 vCPU, 8 GB RAM, or consider dedicated	Multiple databases and sustained checkout load

When comparing VPS hosting plans for a store, look past the base specs to three things: whether you can add memory before a peak without a migration, what backup options exist for order data, and what management support is available if something breaks during a sale.

Order Data and Backups: How Much Can You Afford to Lose?

A nightly backup sounds safe until you work out what it means for a store. If the database fails at 6 p.m., a backup from 2 a.m. restores everything except the 16 hours of orders, customer accounts and stock changes since then.

Two terms help frame the decision:

• Recovery point objective (RPO): how much recent data you can afford to lose. For a busy store, the honest answer is usually “very little”.
• Recovery time objective (RTO): how long you can afford to be offline while restoring.

Backup approach	Orders at risk	Fits
Nightly full backup only	Up to a day	Very low-volume stores
Nightly full backup plus hourly database backups	Up to an hour	Most small and mid-size stores
Database binary logs or replication, plus regular full backups	Minutes or less	Busy stores where every order matters

Whatever approach you choose, follow three rules. Keep at least one copy offsite, away from the server and the provider’s same storage. Remember that RAID protects against a failed drive, not against deletion, corruption or a compromised store. And test a full restore before you need one, ideally to a staging server, so you know how long it actually takes.

On 4GoodHosting’s Linux VPS plans, backups shouldn’t be assumed in the base price. The Tier 3 managed support add-on includes 50 GB of onsite backups; for anything else, confirm options with support and arrange your own offsite copy.

Order Emails: Deliverability on Your Own Server

Order confirmations, shipping notices and password resets are part of the purchase. When they land in spam, customers contact support or assume the order failed.

A VPS comes with its own IP address, which gives you control over email reputation, but also responsibility for it. Before sending order email from your server:

• Publish an SPF record listing the servers allowed to send for your domain.
• Sign mail with DKIM so receiving servers can verify it wasn’t altered.
• Add a DMARC policy, starting in monitoring mode, so you can see who is sending as your domain.
• Set reverse DNS for your server’s IP address to a hostname that matches your sending domain.
• Consider a transactional email service for order mail. Many stores route it through a dedicated sending provider and keep the VPS for the website, which separates email reputation from server issues.

Canadian Requirements for Online Stores

Breach reporting under PIPEDA. Federal privacy law requires organizations to report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner when they create a real risk of significant harm, to notify affected individuals, and to keep records of all such breaches for 24 months. On a VPS you run, detecting and documenting incidents is part of your job, which is another reason to keep logs off the server.

Quebec’s Law 25. Businesses holding Quebec residents’ personal information must report confidentiality incidents that present a risk of serious injury to the Commission d’accès à l’information and keep an incident register. Before communicating personal information outside Quebec, including to a provider in another province, Law 25 requires a privacy impact assessment. Hosting in Toronto or Vancouver doesn’t remove that step for Quebec customer data.

Data location. PIPEDA doesn’t require Canadian data residency, but you’re accountable for personal information you send to service providers elsewhere. Hosting your store, its database and its backups in Canada keeps that story simple to explain in your privacy policy.

Prices and language. Canadian rules on drip pricing require advertised prices to include mandatory fees, other than sales taxes, so a fee added only at checkout can be a problem. If you have an establishment in Quebec, the Charter of the French language applies to commercial publications, which Quebec has applied to business websites, so plan for French product and checkout content.

Speed for Canadian shoppers. A server in the region where most of your customers are shortens every request. That matters most on uncached pages, which is exactly where checkout lives.

What 4GoodHosting’s VPS Hosting Offers Online Stores

4GoodHosting’s VPS hosting runs from data centres in Vancouver and Toronto, so you can place a store near most of its customers. The Linux VPS hosting plans range from 1 vCPU with 3 GB of RAM to 5 vCPU with 8 GB, all with full root access, 10 TB of monthly transfer, one IP address, RAID 10 storage, 24-hour monitoring and Canadian support. Regular monthly prices run from $39.99 to $169.00 CAD before tax, with introductory discounts on longer prepaid terms for the first term only.

For a store, the add-ons matter as much as the base plan. These are 4GoodHosting’s published monthly prices with monthly billing:

Add-on	Monthly price (CAD)	Why a store might need it
cPanel licence, 1–5 accounts	$19.95	A familiar control panel for the store, email and databases
Softaculous	$5.00	One-click installer for WooCommerce and other store platforms (needs a control panel)
Security scanning and patching	$25.00	Optional scanning service; confirm scope before ordering
Tier 3 managed support with backups	$75.00	Level 3 support, 50 GB onsite backups, hardening and software installation
Additional RAM	$15.00 per GB	Extra memory ahead of a peak season
Additional IP address	$3.00	For separating services, where justified

As an example, a growing WooCommerce store on the Enterprise+ plan (3 vCPU, 5 GB RAM, $64.99) with a cPanel licence, Tier 3 managed support and security scanning would come to $184.94 CAD a month before tax with monthly billing. A developer-run store on the same plan without a control panel or management would be $64.99. That gap is the cost of having someone else look after the server, and for most store owners it’s worth comparing honestly with the cost of an outage during a sale.

4GoodHosting also offers a free website transfer service and a 30-day money-back guarantee under its service terms. Confirm what the transfer covers for your plan before scheduling a move.

Common Mistakes When Moving a Store to a VPS

• Testing only the homepage. It’s cached. Test cart, checkout and account pages under load.
• Sizing for average traffic. Your busiest hour, not your monthly visitors, decides whether checkout holds up.
• Assuming a VPS makes you PCI compliant. Compliance depends on your payment flow and practices. Keep card data off your server.
• Loading marketing scripts on checkout. Every extra script on the payment page is a risk. Keep checkout lean.
• Relying on nightly backups. For a store, a day of lost orders is a serious incident. Back up the database more often and test restores.
• Leaving WordPress cron to page visits. Move scheduled tasks to a system cron so order emails and webhooks run on time.
• Updating plugins during a sale. Freeze changes over peak periods.
• Sending order email without SPF, DKIM and DMARC. Confirmations in spam create support tickets and refund requests.
• Choosing self-managed with no one to manage it. The cheapest plan becomes the most expensive the first time it fails on a Saturday.

Store-on-a-VPS Checklist

Before you move

• Confirmed the platform is self-hosted and the problem is capacity, not configuration
• Decided who manages the server: your team or managed support
• Measured peak checkout concurrency and memory per PHP worker
• Chosen a plan with headroom and a path to add memory before peaks
• Priced the full monthly cost, including control panel, management and backups

Payments and security

• Card data handled only by the payment provider’s hosted page or embedded fields
• SAQ type confirmed with your payment provider or acquirer
• Checkout page scripts minimized and restricted with a Content Security Policy
• Two-factor authentication on every admin account
• WAF, file integrity monitoring and off-server logging in place

Operations

• Object cache and system cron configured
• High-Performance Order Storage enabled where supported
• Database backed up at least hourly, with an offsite copy and a tested restore
• SPF, DKIM, DMARC and reverse DNS set for order email
• Peak-season load test, scale-up plan and change freeze scheduled

Canadian obligations

• Breach response plan covering PIPEDA reporting and 24-month records
• Law 25 incident and transfer requirements reviewed for Quebec customers
• Advertised prices include mandatory fees other than tax
• French content planned if you have an establishment in Quebec

FAQ

Do I need VPS hosting for my ecommerce store?

You need VPS hosting for ecommerce if your store is self-hosted, such as WooCommerce, Magento or PrestaShop, and shared hosting can no longer handle cart, checkout and account pages reliably, especially during promotions. If your store runs on a hosted ecommerce platform, the platform runs the servers and you don’t need a VPS for the store itself.

Is VPS hosting good for WooCommerce?

Yes, for growing stores. A VPS lets you add an object cache such as Redis, run scheduled tasks from a system cron, size the database’s memory and tune PHP workers for checkout. Those changes matter most for uncacheable pages. A VPS needs someone to manage it, so compare it with managed WordPress hosting if you don’t want server responsibilities.

Does a VPS make my store PCI compliant?

No. PCI DSS compliance depends on your payment flow, your application, your practices and your policies, not just the server. The simplest way to reduce scope is to keep card data off your server by using your payment provider’s hosted page or embedded card fields. Confirm your validation requirements with your payment provider or acquirer.

What changed for SAQ A in 2025?

In January 2025, the PCI Security Standards Council revised SAQ A for PCI DSS 4.0.1. It removed requirements 6.4.3 and 11.6.1, which deal with payment-page scripts, as line items, and added an eligibility criterion instead: merchants must confirm their site isn’t susceptible to script attacks that could affect their e-commerce systems. Protecting the page that hosts the payment form still matters.

How much RAM does an ecommerce VPS need?

It depends on how many customers check out at the same moment at your busiest time, and how much memory each PHP worker uses. Many small and growing stores start around 4 to 5 GB, while larger catalogues, subscription stores and multi-store setups often need 6 to 8 GB or more. Measure on your current store and size for peak, not average.

How often should an online store back up its database?

More often than nightly for most stores. A nightly backup can lose a full day of orders. Hourly database backups suit most small and mid-size stores, while busy stores often use database binary logs or replication to lose only minutes of data. Keep an offsite copy and test restores regularly.

What does 4GoodHosting’s VPS hosting cost for an online store?

4GoodHosting’s Linux VPS plans ranged from $39.99 to $169.00 CAD a month at regular monthly rates in October 2026, before tax. Stores often add a cPanel licence, managed support with backups and security scanning. For example, the Enterprise+ plan with those add-ons comes to $184.94 CAD a month with monthly billing.

How should I prepare my store’s VPS for Black Friday?

Measure normal peak usage, load test a staging copy with realistic checkout traffic, and add memory or move up a plan in advance if needed. Warm caches after deployments, freeze plugin and theme changes, reschedule backups and imports outside peak hours, check payment and shipping integrations, and monitor checkout and logs during the sale.

Does hosting in Canada matter for a Canadian online store?

It helps. A server near your customers shortens response times on uncached pages such as checkout, and keeping store data and backups in Canada simplifies how you describe data handling under PIPEDA. PIPEDA doesn’t require Canadian data residency, and Quebec’s Law 25 still requires an assessment before personal information leaves Quebec, including to other provinces.

Key Takeaways

• Online stores are harder to host than content sites because cart, checkout and account pages can’t be cached and stores write data constantly.
• VPS hosting for ecommerce applies to self-hosted platforms such as WooCommerce, Magento and PrestaShop; hosted platforms run their own servers.
• A VPS gives a store predictable checkout capacity, a tunable stack and reliable background processing, but someone must manage it.
• A VPS doesn’t make you PCI compliant. Keep card data off your server with your provider’s hosted page or embedded fields.
• Since 2025, SAQ A merchants must confirm their site isn’t susceptible to script attacks, so the page hosting the payment form still needs protection.
• Size VPS hosting plans for peak checkout concurrency and memory per PHP worker, not monthly visitors.
• Back up order data at least hourly, keep an offsite copy, and test restores; RAID is not a backup.
• Set SPF, DKIM, DMARC and reverse DNS before sending order email from your server.
• Canadian stores must plan for PIPEDA breach reporting, Law 25 for Quebec customers, drip-pricing rules and French content where applicable.
• 4GoodHosting’s Linux VPS plans ran from $39.99 to $169.00 CAD a month in October 2026; add-ons for management, backups and security change the real total.

Conclusion

A VPS isn’t a badge of a successful store. It’s a tool for a specific set of problems: checkout that slows under load, background work that falls behind, and software or tuning that shared hosting won’t allow. When those are your problems, VPS hosting solves them well, and gives you room to grow into busier seasons with confidence.

But a store on a VPS carries more responsibility than a store on shared or managed hosting. Payment pages need protecting. Order data needs backing up far more often than nightly. Peak days need planning weeks in advance. Order emails need proper authentication. And Canadian privacy rules expect you to detect and report incidents on a server you control.

Make those decisions deliberately, especially who will run the server, and a VPS becomes the dependable foundation a growing store needs. Skip them, and the server you bought for performance becomes the weakest link in your checkout.

Is Your Store Ready for Its Busiest Season, or Just Hoping?

Talk to 4GoodHosting’s Canadian support team about how your store runs today, where checkout slows down, and what your peak looks like. We’ll help you choose between optimizing your current setup, managed WordPress hosting, or one of our VPS hosting plans in Vancouver or Toronto, with the management and backups your store actually needs.

Compare 4GoodHosting’s VPS hosting plans →
Call 1 866 708 4678 · 24/7 support

 

VPS Backups in 2026: Why Your Canadian VPS Hosting Needs a Real Backup Plan

Short Answer

A VPS backup is a separate, restorable copy of your server’s data, stored away from the server itself. RAID and snapshots help with hardware failures and quick rollbacks, but they don’t protect you from deletion, corruption, hacking, ransomware or a problem with the server or account. A real plan follows the 3-2-1 rule: three copies, on two kinds of storage, with one offsite, ideally including an immutable copy. Choose Canadian VPS hosting that’s clear about what it backs up, then add your own offsite copy and test restores regularly.

Every business that runs a website on a virtual private server is one bad afternoon away from needing a backup. A plugin update corrupts the database. A staff member deletes the wrong folder. An attacker gets in through an outdated component and encrypts everything. A billing problem suspends the account at the worst possible moment. None of these are exotic. They’re the ordinary ways websites lose data.

What turns those afternoons into minor inconveniences, rather than lost orders, lost customers and lost weeks, is a backup you can actually restore. That sounds obvious. Yet backups are one of the most misunderstood parts of hosting. Many business owners assume their host backs everything up. Many hosts describe snapshots, RAID or replication in ways that sound like backups but aren’t. And many backups that do exist have never been restored, so nobody knows whether they work.

This guide explains what a real VPS backup is, what can go wrong without one, how to apply the 3-2-1 rule to a VPS, what to back up and how often, how to keep backups secure, and what Canadian businesses should know about where backups are stored. It finishes with the questions to ask before choosing Canadian VPS hosting, so you know exactly what you’re getting.

RAID, Snapshots, Backups and Replication: What Each Protects Against

These four terms get used interchangeably on hosting pages. They protect against very different things.

Protection	What it is	Protects against	Doesn’t protect against
RAID	Several drives combined so one can fail without data loss	A single drive failing	Deletion, corruption, hacking, ransomware, server or site-wide problems
Snapshot	A point-in-time image of the whole virtual server, usually stored with it	A bad update or change you want to roll back quickly	Problems with the storage or platform that holds the snapshot; attackers with access to your account
Backup	A separate copy of your data, stored elsewhere and kept for a period	Deletion, corruption, hacking and server loss, depending on where it’s kept	Little, if offsite, versioned and tested
Replication	Data copied continuously to another server	Hardware or site failure, with very little data loss	Deletion, corruption and ransomware, which replicate too

The key insight is in the last row. Anything that copies changes immediately, including RAID mirrors and replication, will faithfully copy a deletion or an encryption attack. Only a backup that keeps older versions, stored somewhere an attacker or a mistake can’t reach, lets you go back in time.

Snapshots sit in between. They’re valuable: taking one before a major update lets you roll back in minutes. But if they’re stored on the same platform as your server, they share its risks. Treat them as an undo button, not as your backup.

What Can Actually Go Wrong

Thinking in scenarios makes backup decisions much easier. Here are the common ones, and what saves you in each:

Scenario	How common	What saves you
Someone deletes files, pages or products by mistake	Common	Versioned backups you can restore selectively
A plugin, theme or software update breaks the site	Common	A snapshot taken before the update, or a recent backup
The database is quietly corrupted and nobody notices for days	Occasional	Backups kept long enough to reach a version before the problem
The site is hacked and malicious code is added	Occasional	Clean backups from before the compromise, kept for weeks
Ransomware encrypts the server’s files	Less common, very damaging	Immutable or offline backups the attacker can’t reach
A drive fails	Rare on RAID storage	RAID, then backups if more than one drive fails
The server or data centre has a serious incident	Rare	Offsite backups in a different location
The hosting account is suspended or compromised	Rare, very disruptive	Backups stored with a different account or provider

Two patterns stand out. First, the most common problems are human: mistakes and updates. Second, the most damaging problems are the ones that reach everything connected to your server. That’s why a good plan combines quick, nearby restore points with at least one copy that’s separate in every sense: different storage, different location and different credentials.

How Much Can You Afford to Lose? RPO and RTO

Two simple measures turn backup planning from guesswork into decisions.

Recovery point objective (RPO) is how much recent data you can afford to lose. If you back up nightly, a failure late in the day loses everything since the previous night.

Recovery time objective (RTO) is how long you can afford to be offline while restoring.

Site type	Typical RPO to aim for	Typical RTO to aim for	What that implies
Brochure site that rarely changes	A day or more	A day	Daily backups are plenty
Blog or content site updated daily	A day	Hours	Daily backups plus snapshots before changes
Booking or lead-generation site	Hours	Hours	More frequent database backups
Online store	An hour or less	An hour or two	Hourly or continuous database backups, fast restore path
Business applications staff rely on	An hour or less	Less than a day	Frequent backups and a documented restore procedure

The point of setting these isn’t precision. It’s to notice when your current backups don’t match what the business needs. A store backed up once a night has an RPO of up to a day, which means a day of orders at risk.

The 3-2-1 Rule, Applied to a VPS

The 3-2-1 rule is the most widely used starting point for backup planning:

• 3 copies of your data: the live copy plus two backups.
• 2 different kinds of storage, so one failure mode can’t take out every copy.
• 1 copy offsite, away from the server’s location.

Many organizations now add two more conditions: at least one copy that’s immutable or offline, so it can’t be altered or deleted, and zero errors when backups are verified by test restores.

On a VPS, a practical 3-2-1 setup looks like this:

Copy	Where it lives	Purpose
1. Live data	Your VPS	Running the site
2. Provider backups or snapshots	Your host’s backup system	Fast restores after mistakes and failed updates
3. Offsite backup	Separate storage in another city, with separate credentials, ideally immutable	Recovery from hacking, ransomware, account problems or a location-wide incident

The third copy is the one most small businesses are missing. It’s also the one that matters when everything else has gone wrong.

What to Back Up on a VPS

A VPS holds more than a website’s files. A complete backup plan covers:

• Website files: application code, themes, plugins and uploaded media.
• Databases: usually the most valuable and most frequently changing data. Back them up with a proper database dump or a database-aware backup tool, not by copying the database files while the server runs.
• Server configuration: web server, PHP, database, firewall and scheduled-task settings, so you can rebuild the server the same way.
• Email, if your VPS hosts mailboxes.
• Control panel accounts, if you use one; many control panels can produce full account backups that include files, databases, email and settings.
• SSL certificates and keys, or a note of how to reissue them.
• DNS records, exported from wherever your DNS is managed.
• A recovery document: where backups are, how to restore them, who has access, and which credentials are needed, stored outside the server.

That last item is the one people forget, and the one they need most when the person who set things up is unavailable.

How to Back Up a VPS: the Main Methods

Method	What it does	Strengths	Limitations
Provider snapshots	Images the whole VPS at a point in time	Fast, complete rollbacks	Often stored with the server; may not be application-consistent
Provider backup service	Scheduled backups managed by your host	Convenient, often with easy restores	Same provider and account; check retention and location
Control panel backups	Full account backups, often sent to a remote destination	Complete per-account copies; familiar tools	Needs a remote destination configured
File-level backup tools	Tools such as restic or BorgBackup copy files to remote storage	Encrypted, versioned, efficient, any destination	Needs setup and monitoring
Database dumps	Consistent exports of each database	Reliable restores of the most important data	Must be scheduled and copied offsite
Application backups	Plugins or built-in tools for a specific platform	Easy for one site	Run inside the site; often stored on the same server

Most robust setups combine two or three of these: provider snapshots or backups for quick restores, plus scheduled database dumps and file backups sent to independent offsite storage.

A Note on Database Consistency

A snapshot taken while a database is busy is “crash-consistent”: it’s like pulling the power cord. Databases usually recover from that, but not always cleanly. For important data, take a proper database dump, or use a database-aware backup tool, on a schedule, and include those dumps in your offsite backups. It’s the difference between a backup that restores and one that restores with errors.

Backing Up Common VPS Setups

The principles are the same everywhere, but the details depend on what your VPS runs.

WordPress or WooCommerce on a VPS. Back up the site files, especially the uploads folder, and dump the database on a schedule that matches your RPO; hourly for stores. Include the wp-config.php file, which holds database credentials and keys, in an encrypted backup. A backup plugin can help, but it runs inside the site and usually stores copies on the same server, so make sure its output is sent offsite.

A server with a control panel and several accounts. Control panels such as cPanel can create full account backups that include files, databases, email and settings for each hosting account. Configure them to go to a remote destination rather than the server’s own disk, and confirm that restores work per account, so one client or brand can be restored without touching the others.

Windows VPS. Use backup tools that are aware of running applications, so open files and databases are captured consistently. If the server runs Microsoft SQL Server, schedule native database backups as well as file-level copies, and keep the backup files offsite. Remember to document Remote Desktop and application settings, which are easy to forget when rebuilding.

Custom applications and containers. Back up the data, not just the code. For applications running in containers, that means the persistent volumes and any external databases, plus the configuration needed to recreate the containers. Code that lives in a version control system is already backed up there; data usually isn’t.

Email on the VPS. Mailboxes change constantly and are often overlooked. Include mail directories in file backups, or consider whether a dedicated email service with its own retention would be simpler.

How Often, and for How Long

Frequency follows your RPO. Retention follows how long a problem might go unnoticed.

A common, sensible pattern for a small business VPS:

• Databases: hourly for stores and booking sites; daily for most other sites.
• Files: daily.
• Snapshots: before every significant update or change, plus daily or weekly if your host offers them.
• Retention: daily copies for one to two weeks, weekly copies for one to two months, and monthly copies for several months.

Longer retention matters more than people expect. A hacked site is often discovered days or weeks after the compromise, and a quietly corrupted database can take a while to notice. If you only keep seven days of backups, every copy may already contain the problem.

Balance that against privacy obligations. Backups containing personal information are subject to the same retention principles as live data, so keep them as long as you need for recovery, and no longer than your privacy policy says.

Keeping Backups Safe

A backup is only useful if it survives whatever happened to your server. That means protecting it as carefully as the server itself.

• Separate credentials. The account that stores offsite backups shouldn’t be accessible with credentials kept on the server. If an attacker takes the server, they shouldn’t be able to delete the backups too.
• Immutability. Use storage that supports write-once retention, or object lock, so backups can’t be altered or deleted before a set date, even by an administrator.
• Encryption. Encrypt backups before they leave the server, and store the encryption key somewhere safe and separate. A backup you can’t decrypt is no backup at all.
• Multi-factor authentication on every account that can reach your backups, including the hosting account.
• Monitoring. Get an alert when a backup fails or is missed. Silent failures are the most common reason backups don’t exist when needed.
• Least privilege. Where possible, give the server permission to write new backups but not to delete old ones.

The Canadian Centre for Cyber Security recommends keeping backups separate from the systems they protect and testing them regularly, specifically because ransomware increasingly targets backups as well as live data.

Test Your Restores

A backup that’s never been restored is a hope, not a plan. Test restores on a schedule, at least quarterly, and after any significant change to your setup.

• Restore to a separate place, such as a staging server or a temporary VPS, never over your live site.
• Restore a full site, including files and database, and check that it works: pages load, logins work, recent content is present.
• Restore a single file or database table, since partial restores are what you’ll need most often.
• Time the restore, and compare it with your RTO.
• Note anything that was missing or unclear, such as a configuration file, an encryption key or a password, and fix your plan.
• Record the date and result, so you know when the last successful test happened.

The first test usually reveals something: a database that wasn’t included, a backup that was smaller than it should be, or a step nobody wrote down. That’s exactly why it’s worth doing before you need it.

What a Restore Looks Like in Practice

Backups are easier to plan once you’ve walked through a real restore. Here’s an illustrative example of a hacked online store, the kind of situation where every part of the plan matters.

Day 1. A customer reports a strange redirect on the checkout page. Investigation shows malicious code was added to the site, and the file timestamps suggest it happened five days earlier.

Step 1: contain. Put the store into maintenance mode, change hosting, admin and database passwords, and take a snapshot of the compromised server for later investigation.

Step 2: choose a clean restore point. Because backups are kept for weeks, there’s a clean copy from before the compromise. With only seven days of retention, every backup might already have contained the malicious code.

Step 3: restore to a separate server first. Restore files and the database to a staging server, confirm the malicious code is absent, and update the outdated component that let the attacker in.

Step 4: recover recent data. The clean backup is six days old, so orders placed since then are missing. Export those orders from the payment provider and the order notification emails, and re-enter or import them.

Step 5: switch over and watch. Move the cleaned, patched site into production, monitor closely, and keep the compromised snapshot for investigation.

Step 6: assess privacy obligations. If customer personal information may have been accessed, assess whether the breach creates a real risk of significant harm, and report and notify as PIPEDA requires.

That example shows why retention, a separate restore environment and a documented process matter. The backup itself is only the starting point.

Backups and Canadian Data Centres

For Canadian businesses, where backups are stored deserves as much thought as where the server runs.

Backups are copies of personal information. If your site holds customer accounts, orders, bookings or form submissions, so do your backups. Under PIPEDA, you’re accountable for that information wherever it’s stored, including with a backup provider. PIPEDA doesn’t require it to stay in Canada, but storing backups in Canadian data centres keeps your privacy policy simple and accurate.

Separation within Canada is possible. A backup copy stored in a different Canadian city from your server, such as Toronto for a server in Vancouver, gives you geographic separation without sending data abroad.

Quebec adds a step. If you hold personal information about Quebec residents, Law 25 requires a privacy impact assessment before that information is communicated outside Quebec, and legal commentary notes this includes other provinces. A backup copy in Toronto or Vancouver is still “outside Quebec” for that purpose.

Lost backups can be a breach. If a backup containing personal information is lost, stolen or accessed without authorization, it can be a breach of security safeguards. PIPEDA requires reporting breaches that create a real risk of significant harm, notifying affected individuals and keeping records of breaches for 24 months. Encrypting backups reduces that risk considerably.

Check every link in the chain. If you use a third-party offsite storage service, confirm which region it stores your data in, and choose a Canadian region where one is available.

What Backups Cost, and Why It’s Worth It

Backup costs depend mainly on how much data you store and for how long. Versioned backup tools that store only changes between backups, rather than full copies every time, keep storage costs low even with long retention. For most small business VPS setups, offsite backup storage is a small line item compared with the hosting itself.

The comparison that matters is with the cost of not having a usable backup: lost orders, rebuilding a site from scratch, staff time, and the trust lost with customers. A modest monthly cost for offsite, immutable, tested backups is one of the most cost-effective protections a business can buy.

Choosing Canadian VPS Hosting with Backups That Work

Before choosing Canadian VPS hosting, or relying on the backups that come with it, ask these questions. Many VPS hosting plans describe backups in a sentence; you need the details.

Question	Why it matters
Are backups included in the plan, or an add-on? What does each cost?	Many VPS plans don’t include backups by default
Are they snapshots of the whole server, file-level backups, or both?	Determines whether you can restore one file or only roll back everything
How often do they run, and how long are they kept?	Sets your RPO and how far back you can go
Where are they stored: same server, same data centre, another city?	Determines what incidents they survive
Can I restore myself, or do I need to open a ticket? How long does it take?	Sets your realistic RTO
Are databases backed up consistently?	Prevents restores that come back with errors
Are backups encrypted, and who can access them?	Affects security and privacy obligations
Can I send my own backups offsite from the VPS?	Lets you add the independent third copy
Which Canadian data centres are used for the server and the backups?	Matters for speed, separation and privacy documentation

If the answers are vague, plan your own offsite backups regardless. Even with a strong provider backup, an independent copy protects you from account-level problems.

What 4GoodHosting’s VPS Hosting Offers for Backups

4GoodHosting runs its Linux VPS hosting from data centres in Vancouver and Toronto, which makes cross-country separation within Canada possible. Its Linux VPS hosting plans range from 1 vCPU with 3 GB of RAM to 5 vCPU with 8 GB, at $39.99 to $169.00 CAD a month at regular monthly rates in October 2026, before tax. Storage uses RAID 10, which protects against drive failure but, as 4GoodHosting’s own plan page notes, isn’t a backup.

The confirmed detail: 4GoodHosting’s Tier 3 managed support add-on, at $75 CAD a month, includes 50 GB of onsite backups along with Level 3 support, security hardening and software installation. Whatever plan you choose, ask 4GoodHosting’s support team the questions in the table above, and add your own encrypted offsite copy for the independent third copy.

A Practical Backup Setup for a Small Business VPS

If you’re starting from nothing, this setup covers most small businesses well:

1. Turn on your provider’s backups or snapshots, and confirm frequency, retention and restore process.
2. Schedule database dumps hourly for stores and booking sites, daily otherwise.
3. Back up files and dumps offsite daily with an encrypted, versioned tool, to storage in a different Canadian city, using credentials not kept on the server.
4. Enable immutability on the offsite storage for at least 14 to 30 days.
5. Take a snapshot before every significant update.
6. Set up failure alerts for every backup job.
7. Write a one-page recovery document and store it outside the server.
8. Test a full restore within the first month, then quarterly.
9. Review retention against your privacy policy once a year.

If you’d rather not manage this yourself, a managed support tier or an IT provider can set it up and monitor it. Make sure the scope includes offsite copies and restore testing, not just “backups enabled”.

Common VPS Backup Mistakes

• Treating RAID as a backup. RAID protects against a failed drive, not against deletion, corruption or attack.
• Relying only on snapshots stored with the server. They share the server’s risks.
• Keeping backups on the same server, where a failure or attacker can reach them.
• Using the same credentials for the server and the backup storage.
• Backing up files but not databases, or copying database files while the database is running.
• Keeping too few days of backups to recover from a problem discovered late.
• Never testing a restore.
• No alert when backups fail, so they quietly stop.
• Forgetting email, configuration and DNS.
• Ignoring where backups are stored when writing your privacy policy.

VPS Backup Checklist

Plan

• RPO and RTO set for each site or application
• 3-2-1 plan written: live copy, provider backup, offsite copy
• Retention set: daily, weekly and monthly copies
• Backup storage locations confirmed in Canadian data centres

Implement

• Provider backups or snapshots enabled and understood
• Database dumps scheduled and included in backups
• Encrypted offsite backups to another city, with separate credentials
• Immutability enabled on offsite storage
• Failure alerts set for every backup job
• Recovery document stored outside the server

Verify

• First full restore tested within a month
• Quarterly restore tests scheduled and recorded
• Retention reviewed against your privacy policy
• Law 25 considered for Quebec customers’ data

FAQ

What is a VPS backup?

A VPS backup is a separate copy of your virtual server’s data, such as website files, databases, email and configuration, stored away from the server and kept for a period so you can restore earlier versions. It differs from RAID, which only protects against drive failure, and from snapshots stored alongside the server, which share the server’s risks.

Are snapshots the same as backups?

No. A snapshot is a point-in-time image of the whole server, usually stored on the same platform, and is best used to roll back a failed update quickly. A backup is a separate copy stored elsewhere and kept for longer. Snapshots are useful, but they shouldn’t be your only protection.

Is RAID a backup?

No. RAID combines several drives so the server keeps running if one fails. It copies every change immediately, including deletions, corruption and encrypted files from a ransomware attack. You still need separate, versioned backups stored away from the server.

How often should I back up my VPS?

Back up databases hourly for online stores and booking sites, and daily for most other sites. Back up files daily, and take a snapshot before every significant update. Keep daily copies for one to two weeks, weekly copies for a month or two, and monthly copies for several months.

What is the 3-2-1 backup rule for a VPS?

The 3-2-1 rule means keeping three copies of your data, on two different kinds of storage, with one copy offsite. On a VPS, that’s typically the live server, your host’s backups or snapshots, and an encrypted offsite copy in another location with separate credentials, ideally immutable.

How do I protect VPS backups from ransomware?

Store at least one backup offsite with credentials that aren’t kept on the server, enable immutability so backups can’t be changed or deleted before a set date, encrypt backups, use multi-factor authentication on backup accounts, and keep enough retention to restore from before the attack.

Should my backups stay in Canada?

PIPEDA doesn’t require Canadian storage, but backups containing personal information are your responsibility wherever they’re kept. Storing them in Canadian data centres keeps privacy documentation simple. For Quebec residents’ information, Law 25 requires an assessment before it leaves Quebec, including to other provinces.

What should I ask about backups when choosing Canadian VPS hosting?

When comparing Canadian VPS hosting, ask whether backups are included or extra, whether they’re snapshots or file-level, how often they run and how long they’re kept, where they’re stored, how you restore and how long it takes, whether databases are backed up consistently, and whether you can send your own backups offsite.

Do 4GoodHosting’s VPS hosting plans include backups?

4GoodHosting’s Tier 3 managed support add-on for its VPS hosting plans includes 50 GB of onsite backups. For backup options on other plans, including snapshot retention and where backups are stored, confirm current details with 4GoodHosting’s support team before ordering, and add your own encrypted offsite copy.

Key Takeaways

• A VPS backup is a separate, versioned, restorable copy stored away from the server; RAID and snapshots alone aren’t enough.
• Mistakes and updates cause most data loss; ransomware and account problems cause the most damage.
• Set an RPO and RTO for each site; online stores usually need hourly database backups.
• Apply 3-2-1: live copy, provider backup and an offsite copy, ideally immutable.
• Back up databases with proper dumps, plus files, configuration, email, DNS and a recovery document.
• Keep backups long enough to recover from problems discovered late, but within your privacy policy.
• Protect backups with separate credentials, encryption, immutability, multi-factor authentication and failure alerts.
• Test restores at least quarterly.
• Store backups in Canadian data centres, ideally in a different city from the server; Law 25 still applies to Quebec data leaving the province.
• When choosing Canadian VPS hosting, get specific answers about backup inclusion, frequency, retention, location and restore process.

Conclusion

Backups are the least exciting part of running a VPS and the most important. Nobody notices them until the day they’re needed, and on that day, the only question that matters is whether a clean, recent copy can be restored quickly.

The good news is that a solid backup plan isn’t complicated. Know what RAID and snapshots can and can’t do. Follow the 3-2-1 rule, with one copy that’s offsite, separate and ideally immutable. Back up databases properly. Keep enough history to go back past a problem you didn’t spot straight away. Store backups in Canada, ideally in another city from the server. And test restores before you need them.

Whether your host provides most of this or you build it yourself, the goal is the same: when something goes wrong, and eventually something will, it should cost you an afternoon, not your business.

Do You Know Exactly What Your VPS Backups Would Restore Today?

Talk to 4GoodHosting’s Canadian support team about backups for your VPS: what’s included in your plan, where copies are stored across our Vancouver and Toronto data centres, and how to add managed backups or an offsite copy that fits your business.

Compare Linux VPS hosting plans →
Call 1 866 708 4678 · 24/7 support