VPS Backups in 2026: Why Your Canadian VPS Hosting Needs a Real Backup Plan

Short Answer

A VPS backup is a separate, restorable copy of your server’s data, stored away from the server itself. RAID and snapshots help with hardware failures and quick rollbacks, but they don’t protect you from deletion, corruption, hacking, ransomware or a problem with the server or account. A real plan follows the 3-2-1 rule: three copies, on two kinds of storage, with one offsite, ideally including an immutable copy. Choose Canadian VPS hosting that’s clear about what it backs up, then add your own offsite copy and test restores regularly.

Every business that runs a website on a virtual private server is one bad afternoon away from needing a backup. A plugin update corrupts the database. A staff member deletes the wrong folder. An attacker gets in through an outdated component and encrypts everything. A billing problem suspends the account at the worst possible moment. None of these are exotic. They’re the ordinary ways websites lose data.

What turns those afternoons into minor inconveniences, rather than lost orders, lost customers and lost weeks, is a backup you can actually restore. That sounds obvious. Yet backups are one of the most misunderstood parts of hosting. Many business owners assume their host backs everything up. Many hosts describe snapshots, RAID or replication in ways that sound like backups but aren’t. And many backups that do exist have never been restored, so nobody knows whether they work.

This guide explains what a real VPS backup is, what can go wrong without one, how to apply the 3-2-1 rule to a VPS, what to back up and how often, how to keep backups secure, and what Canadian businesses should know about where backups are stored. It finishes with the questions to ask before choosing Canadian VPS hosting, so you know exactly what you’re getting.

RAID, Snapshots, Backups and Replication: What Each Protects Against

These four terms get used interchangeably on hosting pages. They protect against very different things.

Protection	What it is	Protects against	Doesn’t protect against
RAID	Several drives combined so one can fail without data loss	A single drive failing	Deletion, corruption, hacking, ransomware, server or site-wide problems
Snapshot	A point-in-time image of the whole virtual server, usually stored with it	A bad update or change you want to roll back quickly	Problems with the storage or platform that holds the snapshot; attackers with access to your account
Backup	A separate copy of your data, stored elsewhere and kept for a period	Deletion, corruption, hacking and server loss, depending on where it’s kept	Little, if offsite, versioned and tested
Replication	Data copied continuously to another server	Hardware or site failure, with very little data loss	Deletion, corruption and ransomware, which replicate too

The key insight is in the last row. Anything that copies changes immediately, including RAID mirrors and replication, will faithfully copy a deletion or an encryption attack. Only a backup that keeps older versions, stored somewhere an attacker or a mistake can’t reach, lets you go back in time.

Snapshots sit in between. They’re valuable: taking one before a major update lets you roll back in minutes. But if they’re stored on the same platform as your server, they share its risks. Treat them as an undo button, not as your backup.

What Can Actually Go Wrong

Thinking in scenarios makes backup decisions much easier. Here are the common ones, and what saves you in each:

Scenario	How common	What saves you
Someone deletes files, pages or products by mistake	Common	Versioned backups you can restore selectively
A plugin, theme or software update breaks the site	Common	A snapshot taken before the update, or a recent backup
The database is quietly corrupted and nobody notices for days	Occasional	Backups kept long enough to reach a version before the problem
The site is hacked and malicious code is added	Occasional	Clean backups from before the compromise, kept for weeks
Ransomware encrypts the server’s files	Less common, very damaging	Immutable or offline backups the attacker can’t reach
A drive fails	Rare on RAID storage	RAID, then backups if more than one drive fails
The server or data centre has a serious incident	Rare	Offsite backups in a different location
The hosting account is suspended or compromised	Rare, very disruptive	Backups stored with a different account or provider

Two patterns stand out. First, the most common problems are human: mistakes and updates. Second, the most damaging problems are the ones that reach everything connected to your server. That’s why a good plan combines quick, nearby restore points with at least one copy that’s separate in every sense: different storage, different location and different credentials.

How Much Can You Afford to Lose? RPO and RTO

Two simple measures turn backup planning from guesswork into decisions.

Recovery point objective (RPO) is how much recent data you can afford to lose. If you back up nightly, a failure late in the day loses everything since the previous night.

Recovery time objective (RTO) is how long you can afford to be offline while restoring.

Site type	Typical RPO to aim for	Typical RTO to aim for	What that implies
Brochure site that rarely changes	A day or more	A day	Daily backups are plenty
Blog or content site updated daily	A day	Hours	Daily backups plus snapshots before changes
Booking or lead-generation site	Hours	Hours	More frequent database backups
Online store	An hour or less	An hour or two	Hourly or continuous database backups, fast restore path
Business applications staff rely on	An hour or less	Less than a day	Frequent backups and a documented restore procedure

The point of setting these isn’t precision. It’s to notice when your current backups don’t match what the business needs. A store backed up once a night has an RPO of up to a day, which means a day of orders at risk.

The 3-2-1 Rule, Applied to a VPS

The 3-2-1 rule is the most widely used starting point for backup planning:

• 3 copies of your data: the live copy plus two backups.
• 2 different kinds of storage, so one failure mode can’t take out every copy.
• 1 copy offsite, away from the server’s location.

Many organizations now add two more conditions: at least one copy that’s immutable or offline, so it can’t be altered or deleted, and zero errors when backups are verified by test restores.

On a VPS, a practical 3-2-1 setup looks like this:

Copy	Where it lives	Purpose
1. Live data	Your VPS	Running the site
2. Provider backups or snapshots	Your host’s backup system	Fast restores after mistakes and failed updates
3. Offsite backup	Separate storage in another city, with separate credentials, ideally immutable	Recovery from hacking, ransomware, account problems or a location-wide incident

The third copy is the one most small businesses are missing. It’s also the one that matters when everything else has gone wrong.

What to Back Up on a VPS

A VPS holds more than a website’s files. A complete backup plan covers:

• Website files: application code, themes, plugins and uploaded media.
• Databases: usually the most valuable and most frequently changing data. Back them up with a proper database dump or a database-aware backup tool, not by copying the database files while the server runs.
• Server configuration: web server, PHP, database, firewall and scheduled-task settings, so you can rebuild the server the same way.
• Email, if your VPS hosts mailboxes.
• Control panel accounts, if you use one; many control panels can produce full account backups that include files, databases, email and settings.
• SSL certificates and keys, or a note of how to reissue them.
• DNS records, exported from wherever your DNS is managed.
• A recovery document: where backups are, how to restore them, who has access, and which credentials are needed, stored outside the server.

That last item is the one people forget, and the one they need most when the person who set things up is unavailable.

How to Back Up a VPS: the Main Methods

Method	What it does	Strengths	Limitations
Provider snapshots	Images the whole VPS at a point in time	Fast, complete rollbacks	Often stored with the server; may not be application-consistent
Provider backup service	Scheduled backups managed by your host	Convenient, often with easy restores	Same provider and account; check retention and location
Control panel backups	Full account backups, often sent to a remote destination	Complete per-account copies; familiar tools	Needs a remote destination configured
File-level backup tools	Tools such as restic or BorgBackup copy files to remote storage	Encrypted, versioned, efficient, any destination	Needs setup and monitoring
Database dumps	Consistent exports of each database	Reliable restores of the most important data	Must be scheduled and copied offsite
Application backups	Plugins or built-in tools for a specific platform	Easy for one site	Run inside the site; often stored on the same server

Most robust setups combine two or three of these: provider snapshots or backups for quick restores, plus scheduled database dumps and file backups sent to independent offsite storage.

A Note on Database Consistency

A snapshot taken while a database is busy is “crash-consistent”: it’s like pulling the power cord. Databases usually recover from that, but not always cleanly. For important data, take a proper database dump, or use a database-aware backup tool, on a schedule, and include those dumps in your offsite backups. It’s the difference between a backup that restores and one that restores with errors.

Backing Up Common VPS Setups

The principles are the same everywhere, but the details depend on what your VPS runs.

WordPress or WooCommerce on a VPS. Back up the site files, especially the uploads folder, and dump the database on a schedule that matches your RPO; hourly for stores. Include the wp-config.php file, which holds database credentials and keys, in an encrypted backup. A backup plugin can help, but it runs inside the site and usually stores copies on the same server, so make sure its output is sent offsite.

A server with a control panel and several accounts. Control panels such as cPanel can create full account backups that include files, databases, email and settings for each hosting account. Configure them to go to a remote destination rather than the server’s own disk, and confirm that restores work per account, so one client or brand can be restored without touching the others.

Windows VPS. Use backup tools that are aware of running applications, so open files and databases are captured consistently. If the server runs Microsoft SQL Server, schedule native database backups as well as file-level copies, and keep the backup files offsite. Remember to document Remote Desktop and application settings, which are easy to forget when rebuilding.

Custom applications and containers. Back up the data, not just the code. For applications running in containers, that means the persistent volumes and any external databases, plus the configuration needed to recreate the containers. Code that lives in a version control system is already backed up there; data usually isn’t.

Email on the VPS. Mailboxes change constantly and are often overlooked. Include mail directories in file backups, or consider whether a dedicated email service with its own retention would be simpler.

How Often, and for How Long

Frequency follows your RPO. Retention follows how long a problem might go unnoticed.

A common, sensible pattern for a small business VPS:

• Databases: hourly for stores and booking sites; daily for most other sites.
• Files: daily.
• Snapshots: before every significant update or change, plus daily or weekly if your host offers them.
• Retention: daily copies for one to two weeks, weekly copies for one to two months, and monthly copies for several months.

Longer retention matters more than people expect. A hacked site is often discovered days or weeks after the compromise, and a quietly corrupted database can take a while to notice. If you only keep seven days of backups, every copy may already contain the problem.

Balance that against privacy obligations. Backups containing personal information are subject to the same retention principles as live data, so keep them as long as you need for recovery, and no longer than your privacy policy says.

Keeping Backups Safe

A backup is only useful if it survives whatever happened to your server. That means protecting it as carefully as the server itself.

• Separate credentials. The account that stores offsite backups shouldn’t be accessible with credentials kept on the server. If an attacker takes the server, they shouldn’t be able to delete the backups too.
• Immutability. Use storage that supports write-once retention, or object lock, so backups can’t be altered or deleted before a set date, even by an administrator.
• Encryption. Encrypt backups before they leave the server, and store the encryption key somewhere safe and separate. A backup you can’t decrypt is no backup at all.
• Multi-factor authentication on every account that can reach your backups, including the hosting account.
• Monitoring. Get an alert when a backup fails or is missed. Silent failures are the most common reason backups don’t exist when needed.
• Least privilege. Where possible, give the server permission to write new backups but not to delete old ones.

The Canadian Centre for Cyber Security recommends keeping backups separate from the systems they protect and testing them regularly, specifically because ransomware increasingly targets backups as well as live data.

Test Your Restores

A backup that’s never been restored is a hope, not a plan. Test restores on a schedule, at least quarterly, and after any significant change to your setup.

• Restore to a separate place, such as a staging server or a temporary VPS, never over your live site.
• Restore a full site, including files and database, and check that it works: pages load, logins work, recent content is present.
• Restore a single file or database table, since partial restores are what you’ll need most often.
• Time the restore, and compare it with your RTO.
• Note anything that was missing or unclear, such as a configuration file, an encryption key or a password, and fix your plan.
• Record the date and result, so you know when the last successful test happened.

The first test usually reveals something: a database that wasn’t included, a backup that was smaller than it should be, or a step nobody wrote down. That’s exactly why it’s worth doing before you need it.

What a Restore Looks Like in Practice

Backups are easier to plan once you’ve walked through a real restore. Here’s an illustrative example of a hacked online store, the kind of situation where every part of the plan matters.

Day 1. A customer reports a strange redirect on the checkout page. Investigation shows malicious code was added to the site, and the file timestamps suggest it happened five days earlier.

Step 1: contain. Put the store into maintenance mode, change hosting, admin and database passwords, and take a snapshot of the compromised server for later investigation.

Step 2: choose a clean restore point. Because backups are kept for weeks, there’s a clean copy from before the compromise. With only seven days of retention, every backup might already have contained the malicious code.

Step 3: restore to a separate server first. Restore files and the database to a staging server, confirm the malicious code is absent, and update the outdated component that let the attacker in.

Step 4: recover recent data. The clean backup is six days old, so orders placed since then are missing. Export those orders from the payment provider and the order notification emails, and re-enter or import them.

Step 5: switch over and watch. Move the cleaned, patched site into production, monitor closely, and keep the compromised snapshot for investigation.

Step 6: assess privacy obligations. If customer personal information may have been accessed, assess whether the breach creates a real risk of significant harm, and report and notify as PIPEDA requires.

That example shows why retention, a separate restore environment and a documented process matter. The backup itself is only the starting point.

Backups and Canadian Data Centres

For Canadian businesses, where backups are stored deserves as much thought as where the server runs.

Backups are copies of personal information. If your site holds customer accounts, orders, bookings or form submissions, so do your backups. Under PIPEDA, you’re accountable for that information wherever it’s stored, including with a backup provider. PIPEDA doesn’t require it to stay in Canada, but storing backups in Canadian data centres keeps your privacy policy simple and accurate.

Separation within Canada is possible. A backup copy stored in a different Canadian city from your server, such as Toronto for a server in Vancouver, gives you geographic separation without sending data abroad.

Quebec adds a step. If you hold personal information about Quebec residents, Law 25 requires a privacy impact assessment before that information is communicated outside Quebec, and legal commentary notes this includes other provinces. A backup copy in Toronto or Vancouver is still “outside Quebec” for that purpose.

Lost backups can be a breach. If a backup containing personal information is lost, stolen or accessed without authorization, it can be a breach of security safeguards. PIPEDA requires reporting breaches that create a real risk of significant harm, notifying affected individuals and keeping records of breaches for 24 months. Encrypting backups reduces that risk considerably.

Check every link in the chain. If you use a third-party offsite storage service, confirm which region it stores your data in, and choose a Canadian region where one is available.

What Backups Cost, and Why It’s Worth It

Backup costs depend mainly on how much data you store and for how long. Versioned backup tools that store only changes between backups, rather than full copies every time, keep storage costs low even with long retention. For most small business VPS setups, offsite backup storage is a small line item compared with the hosting itself.

The comparison that matters is with the cost of not having a usable backup: lost orders, rebuilding a site from scratch, staff time, and the trust lost with customers. A modest monthly cost for offsite, immutable, tested backups is one of the most cost-effective protections a business can buy.

Choosing Canadian VPS Hosting with Backups That Work

Before choosing Canadian VPS hosting, or relying on the backups that come with it, ask these questions. Many VPS hosting plans describe backups in a sentence; you need the details.

Question	Why it matters
Are backups included in the plan, or an add-on? What does each cost?	Many VPS plans don’t include backups by default
Are they snapshots of the whole server, file-level backups, or both?	Determines whether you can restore one file or only roll back everything
How often do they run, and how long are they kept?	Sets your RPO and how far back you can go
Where are they stored: same server, same data centre, another city?	Determines what incidents they survive
Can I restore myself, or do I need to open a ticket? How long does it take?	Sets your realistic RTO
Are databases backed up consistently?	Prevents restores that come back with errors
Are backups encrypted, and who can access them?	Affects security and privacy obligations
Can I send my own backups offsite from the VPS?	Lets you add the independent third copy
Which Canadian data centres are used for the server and the backups?	Matters for speed, separation and privacy documentation

If the answers are vague, plan your own offsite backups regardless. Even with a strong provider backup, an independent copy protects you from account-level problems.

What 4GoodHosting’s VPS Hosting Offers for Backups

4GoodHosting runs its Linux VPS hosting from data centres in Vancouver and Toronto, which makes cross-country separation within Canada possible. Its Linux VPS hosting plans range from 1 vCPU with 3 GB of RAM to 5 vCPU with 8 GB, at $39.99 to $169.00 CAD a month at regular monthly rates in October 2026, before tax. Storage uses RAID 10, which protects against drive failure but, as 4GoodHosting’s own plan page notes, isn’t a backup.

The confirmed detail: 4GoodHosting’s Tier 3 managed support add-on, at $75 CAD a month, includes 50 GB of onsite backups along with Level 3 support, security hardening and software installation. Whatever plan you choose, ask 4GoodHosting’s support team the questions in the table above, and add your own encrypted offsite copy for the independent third copy.

A Practical Backup Setup for a Small Business VPS

If you’re starting from nothing, this setup covers most small businesses well:

1. Turn on your provider’s backups or snapshots, and confirm frequency, retention and restore process.
2. Schedule database dumps hourly for stores and booking sites, daily otherwise.
3. Back up files and dumps offsite daily with an encrypted, versioned tool, to storage in a different Canadian city, using credentials not kept on the server.
4. Enable immutability on the offsite storage for at least 14 to 30 days.
5. Take a snapshot before every significant update.
6. Set up failure alerts for every backup job.
7. Write a one-page recovery document and store it outside the server.
8. Test a full restore within the first month, then quarterly.
9. Review retention against your privacy policy once a year.

If you’d rather not manage this yourself, a managed support tier or an IT provider can set it up and monitor it. Make sure the scope includes offsite copies and restore testing, not just “backups enabled”.

Common VPS Backup Mistakes

• Treating RAID as a backup. RAID protects against a failed drive, not against deletion, corruption or attack.
• Relying only on snapshots stored with the server. They share the server’s risks.
• Keeping backups on the same server, where a failure or attacker can reach them.
• Using the same credentials for the server and the backup storage.
• Backing up files but not databases, or copying database files while the database is running.
• Keeping too few days of backups to recover from a problem discovered late.
• Never testing a restore.
• No alert when backups fail, so they quietly stop.
• Forgetting email, configuration and DNS.
• Ignoring where backups are stored when writing your privacy policy.

VPS Backup Checklist

Plan

• RPO and RTO set for each site or application
• 3-2-1 plan written: live copy, provider backup, offsite copy
• Retention set: daily, weekly and monthly copies
• Backup storage locations confirmed in Canadian data centres

Implement

• Provider backups or snapshots enabled and understood
• Database dumps scheduled and included in backups
• Encrypted offsite backups to another city, with separate credentials
• Immutability enabled on offsite storage
• Failure alerts set for every backup job
• Recovery document stored outside the server

Verify

• First full restore tested within a month
• Quarterly restore tests scheduled and recorded
• Retention reviewed against your privacy policy
• Law 25 considered for Quebec customers’ data

FAQ

What is a VPS backup?

A VPS backup is a separate copy of your virtual server’s data, such as website files, databases, email and configuration, stored away from the server and kept for a period so you can restore earlier versions. It differs from RAID, which only protects against drive failure, and from snapshots stored alongside the server, which share the server’s risks.

Are snapshots the same as backups?

No. A snapshot is a point-in-time image of the whole server, usually stored on the same platform, and is best used to roll back a failed update quickly. A backup is a separate copy stored elsewhere and kept for longer. Snapshots are useful, but they shouldn’t be your only protection.

Is RAID a backup?

No. RAID combines several drives so the server keeps running if one fails. It copies every change immediately, including deletions, corruption and encrypted files from a ransomware attack. You still need separate, versioned backups stored away from the server.

How often should I back up my VPS?

Back up databases hourly for online stores and booking sites, and daily for most other sites. Back up files daily, and take a snapshot before every significant update. Keep daily copies for one to two weeks, weekly copies for a month or two, and monthly copies for several months.

What is the 3-2-1 backup rule for a VPS?

The 3-2-1 rule means keeping three copies of your data, on two different kinds of storage, with one copy offsite. On a VPS, that’s typically the live server, your host’s backups or snapshots, and an encrypted offsite copy in another location with separate credentials, ideally immutable.

How do I protect VPS backups from ransomware?

Store at least one backup offsite with credentials that aren’t kept on the server, enable immutability so backups can’t be changed or deleted before a set date, encrypt backups, use multi-factor authentication on backup accounts, and keep enough retention to restore from before the attack.

Should my backups stay in Canada?

PIPEDA doesn’t require Canadian storage, but backups containing personal information are your responsibility wherever they’re kept. Storing them in Canadian data centres keeps privacy documentation simple. For Quebec residents’ information, Law 25 requires an assessment before it leaves Quebec, including to other provinces.

What should I ask about backups when choosing Canadian VPS hosting?

When comparing Canadian VPS hosting, ask whether backups are included or extra, whether they’re snapshots or file-level, how often they run and how long they’re kept, where they’re stored, how you restore and how long it takes, whether databases are backed up consistently, and whether you can send your own backups offsite.

Do 4GoodHosting’s VPS hosting plans include backups?

4GoodHosting’s Tier 3 managed support add-on for its VPS hosting plans includes 50 GB of onsite backups. For backup options on other plans, including snapshot retention and where backups are stored, confirm current details with 4GoodHosting’s support team before ordering, and add your own encrypted offsite copy.

Key Takeaways

• A VPS backup is a separate, versioned, restorable copy stored away from the server; RAID and snapshots alone aren’t enough.
• Mistakes and updates cause most data loss; ransomware and account problems cause the most damage.
• Set an RPO and RTO for each site; online stores usually need hourly database backups.
• Apply 3-2-1: live copy, provider backup and an offsite copy, ideally immutable.
• Back up databases with proper dumps, plus files, configuration, email, DNS and a recovery document.
• Keep backups long enough to recover from problems discovered late, but within your privacy policy.
• Protect backups with separate credentials, encryption, immutability, multi-factor authentication and failure alerts.
• Test restores at least quarterly.
• Store backups in Canadian data centres, ideally in a different city from the server; Law 25 still applies to Quebec data leaving the province.
• When choosing Canadian VPS hosting, get specific answers about backup inclusion, frequency, retention, location and restore process.

Conclusion

Backups are the least exciting part of running a VPS and the most important. Nobody notices them until the day they’re needed, and on that day, the only question that matters is whether a clean, recent copy can be restored quickly.

The good news is that a solid backup plan isn’t complicated. Know what RAID and snapshots can and can’t do. Follow the 3-2-1 rule, with one copy that’s offsite, separate and ideally immutable. Back up databases properly. Keep enough history to go back past a problem you didn’t spot straight away. Store backups in Canada, ideally in another city from the server. And test restores before you need them.

Whether your host provides most of this or you build it yourself, the goal is the same: when something goes wrong, and eventually something will, it should cost you an afternoon, not your business.

Do You Know Exactly What Your VPS Backups Would Restore Today?

Talk to 4GoodHosting’s Canadian support team about backups for your VPS: what’s included in your plan, where copies are stored across our Vancouver and Toronto data centres, and how to add managed backups or an offsite copy that fits your business.

Compare Linux VPS hosting plans →
Call 1 866 708 4678 · 24/7 support