Recommended Free Tools
The safest way to store personal Linux VPS backups is a layered design: create application-consistent exports, encrypt and deduplicate snapshots with restic or Borg, keep one repository close for fast restores, replicate another copy off-site, and rotate an encrypted external hard drive when the data justifies it. Keep passwords and recovery keys outside the VPS, apply retention rules, and regularly perform test restores.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a dependable VPS backup archive looks like
A backup is not just a file uploaded somewhere. It is a recovery system that must still work after a disk failure, provider outage, accidental deletion, compromised credentials, or ransomware attack. For a personal VPS, use several layers with different failure domains:
As an Amazon Associate I earn from qualifying purchases.
- Application-consistent exports: Dump databases and export other stateful services before collecting files.
- Encrypted snapshots on the VPS: Run restic or Borg to create deduplicated, authenticated recovery points.
- A nearby repository: Keep a local disk or attached volume for quick recovery when the VPS remains reachable.
- An off-site repository: Replicate snapshots to a geographically separate server or object-storage destination.
- An offline rotation copy: When the data is valuable enough, periodically copy an encrypted repository or archive to an external hard drive and disconnect it.
- Separate recovery information: Store repository passwords, exported keys, and restoration instructions somewhere other than the VPS.
These layers solve different problems. A local copy reduces restore time, an off-site copy survives a provider or site incident, and an offline copy limits what an attacker controlling the VPS can destroy. No single repository should be treated as the entire plan.
Why database dumps and service exports come first
Archiving a live database directory while the database is writing can produce files that look complete but cannot be opened consistently. Before the snapshot job runs, create a logical export or use the database’s documented hot-backup method.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
PostgreSQL example
install -d -m 700 /var/backups/vps-dumps
pg_dump --format=custom --file=/var/backups/vps-dumps/app-$(date +%F).dump appdbThe custom-format dump is restored with PostgreSQL’s restore tools and should be tested in a disposable instance. For a cluster with multiple databases and roles, use an appropriate cluster-level export as well.
MySQL or MariaDB example
install -d -m 700 /var/backups/vps-dumps
mysqldump --single-transaction --routines --events --all-databases > /var/backups/vps-dumps/mysql-$(date +%F).sql--single-transaction is suitable for transactional tables such as InnoDB, but it is not a universal consistency guarantee for every engine or workload. Follow the database vendor’s backup guidance when in doubt.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOther state that needs an export
- Export application configuration, secrets references, and deployment manifests. Do not place plaintext secrets in a repository merely for convenience.
- Save virtual-host definitions, TLS configuration, firewall rules, scheduled jobs, and service-unit files.
- For mail, forums, wikis, and similar applications, export internal data in the format the application can import.
- Include user-uploaded files and media, but exclude caches, package caches, and reproducible build output unless they are required for recovery.
Place dumps in a directory that the backup process can read, protect it with restrictive permissions, and define how long temporary dumps remain. The archive should contain the dump and the files needed to rebuild the service, not an unsafe snapshot of a half-written database.
Restic and Borg: which repository tool fits?
Both tools run on the client VPS, perform client-side encryption, split data into content-defined chunks, and reuse unchanged chunks in later snapshots. The repository can be local or reached over a network. The practical choice usually depends on the destination and the restore workflow rather than on headline features.
| Consideration | Restic | Borg |
|---|---|---|
| Repository model | A repository directory containing encrypted data, metadata, and keys; local or remote backends are supported. | A self-contained repository of encrypted objects and archives; local paths and SSH destinations are common. |
| Space efficiency | Content-defined chunking and deduplication; later snapshots reuse existing data. | Content-defined chunking and deduplication; unchanged chunks are reused between archives. |
| Encryption and integrity | Client-side encryption with authenticated repository contents. | Client-side encryption with authenticated integrity; exporting the key is essential. |
| Compression | Supported in current documentation; select settings according to CPU and transfer limits. | Offers compression choices, including fast and higher-ratio modes such as zstd. |
| Restore ergonomics | List snapshots and restore selected paths; supported workflows can mount a repository. | Extract an archive or mount it as a user-space filesystem. |
| Operational risk | Someone who can write to the storage location may delete repository data even though they cannot read it. | An attacker with access to the remote server may delete archives or make them unavailable despite encryption. |
Restic’s model is convenient when you want a consistent command-line interface across local disks, SFTP, and object-storage backends. Borg’s archive model is explicit: the Borg quick start describes an archive as the result of one borg create operation, so each archive represents a point in time. Borg’s FAQ also separates responsibilities clearly: the client performs deduplication, encryption, compression, backup, and restore, while the server performs low-level repository storage operations.
Neither tool by itself prevents deletion. Encryption protects confidentiality and authenticated data protects against undetected tampering, but an attacker who can remove repository files can still cause data loss. Choose the tool you can automate, monitor, and restore confidently, then apply destination restrictions and maintain another copy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose storage locations by failure domain
Local disk or an attached volume
A repository on a second disk or provider-attached volume gives the fastest recovery while the VPS is online. Do not confuse a separate directory on the same filesystem with a separate backup: disk corruption, ransomware, and an accidental volume deletion can affect both. Confirm how the provider handles volume snapshots, detachment, and deletion before relying on them.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Geographically separate server or object storage
An off-site repository protects against a provider outage, a deleted VPS, and incidents affecting the whole hosting location. Encrypt before data leaves the VPS. Use a separate account or access key, limit it to the repository path or bucket, and avoid granting broad administrative permissions to the backup job.
Object storage is a category-level destination rather than a single product. Check its lifecycle, deletion-protection, versioning, minimum-retention, egress, and regional policies. A low-cost storage tier can become expensive or slow to restore if retrieval rules are overlooked.
External hard drive for VPS backups
An external hard drive or SSD is useful as a rotated offline copy. Encrypt the filesystem or repository, label the device with a non-sensitive identifier, store it in a dry and secure location, and disconnect it after the copy completes. Keep at least two drives if the data is irreplaceable so one can be off-site while the other is being refreshed. Reconnect and test each drive periodically; an unplugged disk that has silently failed is not a backup.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Canonical’s Ubuntu Server backup guidance recommends keeping important backup media off-site for disaster protection. The same principle applies to a personal VPS: distance and offline time are controls against shared incidents and destructive credentials.
Initialize an encrypted repository
Run the backup tool as a dedicated account with only the permissions needed to read the data. Keep the repository outside the web server’s document root and do not expose it through HTTP.
Restic workflow
- Create a repository on a local disk, remote SFTP destination, or object-storage backend. A local example is
restic -r /srv/backup-repo init. - Provide the repository password through a protected environment file, password command, or secret manager. Do not put it directly in shell history or a world-readable unit file.
- Export the repository key or recovery material according to the tool’s documentation and store it separately from the VPS.
- Create a first snapshot, for example
restic -r /srv/backup-repo backup /etc /home /var/backups/vps-dumps. Add application data directories explicitly and exclude caches or temporary files with an exclude file. - Check that the snapshot is visible with
restic -r /srv/backup-repo snapshots, then run the repository check command on a schedule.
For remote storage, replace the repository address with the backend-specific form and configure credentials with the provider’s least-privilege mechanism. Test the destination from a staging directory before making it the only off-site copy.
Borg workflow
- Initialize a repository with authenticated encryption, such as
borg init --encryption=repokey-blake2 /srv/backup-repo. Select the encryption mode supported by the Borg version you operate. - Save the passphrase and export the key. Losing both the repository and its only key copy makes an otherwise intact archive unusable.
- Create a named archive, for example
borg create --stats /srv/backup-repo::'{hostname}-{now}' /etc /home /var/backups/vps-dumps. - List archives with
borg list /srv/backup-repoand inspect repository integrity withborg check /srv/backup-repo. - For an SSH destination, use a restricted remote account and a repository path that account cannot use for unrelated commands.
Borg needs free space for repository indexes, cache data, temporary files, and compaction. Keep headroom on both the source VPS and destination filesystem; a repository that reaches 100 percent usage can fail during normal maintenance even when the stored data itself would fit.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Automate snapshots without creating a fragile job
Use a wrapper script so the sequence is visible and failures are logged. A typical order is:
- Acquire a lock so two runs cannot overlap.
- Run database and application exports.
- Run restic or Borg against the export directory and selected system paths.
- Apply retention on the repository after a successful snapshot.
- Replicate or push the resulting repository to the off-site destination.
- Record exit status and alert on failure.
A minimal shell outline looks like this:
#!/bin/sh
set -eu
# 1. create application-consistent dumps here
# 2. run the snapshot command here
# 3. run retention only after a successful snapshot
# 4. replicate to the off-site destination
Schedule the wrapper with a systemd timer or cron. Systemd timers make it easier to set a randomized delay, resource limits, and dependency on network availability; cron is adequate for a simple, monitored host. Whichever scheduler you use, send output to a log and alert when the command exits non-zero or when no recent snapshot appears.
Run heavy compression and repository maintenance outside peak application hours. If CPU or bandwidth is limited, choose faster compression, cap parallel work, or split the first full backup from the recurring incremental schedule.
Set retention around the loss you can tolerate
Retention is a recovery decision, not a universal number. Ask how far back a mistaken deletion, corrupted deployment, or compromised account might be discovered. A practical policy commonly has three tiers:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Recent: frequent snapshots for the last several days, covering rapid rollback.
- Intermediate: daily or weekly points retained for several weeks, covering delayed discovery.
- Long-lived: monthly or milestone copies retained for the period required by personal, contractual, or legal needs.
The exact counts depend on archive size, daily change rate, available storage, and the cost of losing a given period. Deduplication reduces repeated data but does not make retention free. Leave room for indexes, temporary files, and compaction, and measure repository growth after the first few weeks rather than estimating from one upload.
Keep one retention policy for the local repository and a longer or differently timed policy off-site when capacity permits. Do not prune every destination at the same instant: a mistaken deletion or compromised automation account should not erase every historical point.
Reduce ransomware and deletion risk
Assume that a stolen VPS credential can reach anything the backup job can write. Apply controls at the destination:
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Use a dedicated backup identity with access only to the repository.
- Prefer append-only, write-once, object-lock, or versioned storage features where the destination supports them.
- Separate credentials for local backup creation and off-site replication so one compromise does not grant every capability.
- Keep an offline external drive disconnected except during a controlled rotation.
- Store the repository password and key export in a password manager or other independent secure location, with a second authorized recovery path.
- Restrict SSH keys by command, source address, and filesystem path when the remote service allows it.
- Monitor for unusual deletion, sudden repository growth, failed checks, and a gap in expected snapshot times.
Encryption does not make deletion impossible. Restic’s threat model and Borg’s operational guidance both distinguish confidentiality from availability: an attacker may be unable to decrypt data yet still remove it. At least one independent copy must therefore have a different credential, destination, or physical connection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Document and test the recovery path
Write a recovery note before an emergency. Include:
- VPS provider and region, DNS details, and the operating-system release to install on a replacement host.
- Restic or Borg version, repository addresses, backend credentials, password location, and key-export location.
- Commands for listing snapshots, extracting files, restoring database dumps, and starting services.
- Which directories are authoritative and which files are caches that can be rebuilt.
- Contact details or access steps for any second person who may need to perform the restore.
Keep a printed or offline copy of the essential instructions if the only digital copy is on the VPS. Do not print secret passwords; record where an authorized person can retrieve them.
Restore selected files
Always restore into a temporary directory first so you can compare permissions and ownership before replacing live data.
mkdir -p /srv/restore-test
restic -r /srv/backup-repo restore latest --target /srv/restore-testFor Borg, inspect an archive with borg list /srv/backup-repo, then extract selected paths with borg extract /srv/backup-repo::ARCHIVE etc/nginx. Borg archives can also be mounted as a user-space filesystem for browsing before extraction.
Rebuild after total VPS loss
- Provision a replacement VPS with a patched operating system and restrictive firewall defaults.
- Install the exact or a compatible restic or Borg version and retrieve the password and key from their independent locations.
- Connect to the off-site repository and list snapshots before changing anything.
- Restore configuration and application files into a staging path, review ownership and permissions, then move them into service directories.
- Restore a database dump into a disposable database instance. Run migrations only after confirming the dump opens and the application can read representative records.
- Recreate users, scheduled jobs, TLS certificates, and service dependencies; update DNS only after the replacement passes a functional check.
A successful upload does not prove recoverability. At a useful interval, restore representative documents, a configuration file, and a database dump on a separate directory or replacement host. Record how long the process takes and fix missing packages, permissions, keys, or undocumented steps immediately.
Troubleshoot common failures
The repository is full
Check free space, repository indexes, temporary working space, and cache locations. Prune according to the retention policy, then run compaction or maintenance when enough headroom exists. Do not delete repository files manually.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
The backup job succeeds but no new snapshot appears
Inspect the scheduler’s environment, lock files, credentials, and exclude rules. A command may be running as a different user or writing to a different repository than the one you inspect. Alert on snapshot age, not only on process exit codes.
Remote replication is slow or repeatedly interrupted
Verify network reachability, destination quotas, and authentication. Reduce compression cost or schedule transfers outside busy periods. Resume from the repository rather than restarting a full export when the tool supports incremental transfer.
The password or key is missing
Stop pruning or rotating copies until recovery material is located. Search the documented independent password store and key export location. If neither exists, assume the encrypted repository may be irrecoverable and create a new repository after preserving the old data for specialist recovery.
A restore has wrong ownership or permissions
Restore to staging, inspect numeric user and group IDs, and recreate service accounts before moving files into production paths. Check restrictive modes on secrets and database dumps.
A practical baseline for a personal VPS
For a small personal server, a sensible starting design is one encrypted restic or Borg repository on a separate local volume, a second repository replicated to a different region or object-storage destination, and an encrypted external hard drive rotated on a schedule that matches the value of the data. Run database dumps before each snapshot, retain several recent points plus older weekly and monthly points, and keep the key and instructions outside the VPS. Verify a file restore regularly and perform a complete replacement-host exercise at least occasionally.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This design deliberately trades a little storage and administration for independent recovery paths. The most important property is not whether restic or Borg wins a feature comparison; it is whether you can still obtain an intact, usable archive after the original VPS and its credentials are unavailable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
