Backup layers and full-system backups

Backups feel optional right up until the day they are not.
A reliable strategy uses multiple independent layers so a failure in one system does not remove your ability to recover.

Updated: January 2026

The short version

Arcustech VPS plans include off-server, off-site full-system backups. These backups behave like snapshots in practice, restoring an entire VPS to a point in time, but they are not filesystem-level snapshots stored on the server itself.

Instead, they are full-disk backups captured at the drive level and stored on dedicated backup systems outside the customer VPS environment. This design avoids the risks of on-server snapshots while still providing fast, point-in-time recovery.

For most production sites, especially commercial workloads, we recommend layering full-system backups with independent tools that can restore individual files or databases without rolling back the entire server.

Practical rule: All backups should be off-server and stored outside the primary data center or region. Use multiple backup layers so a failure in one system does not take out the others.

Full-system backups vs filesystem snapshots

Filesystem snapshots (such as ZFS snapshots) typically live on the same storage system as the server itself. They are fast and convenient, but they do not protect against storage failure, host loss, or data center outages.

Arcustech full-system backups take a different approach. They capture the entire VPS disk and store it off-server and off-site, in dedicated backup locations separate from customer VPS infrastructure.

  • Snapshot-like recovery: restore the entire VPS to a specific point in time.
  • Off-system storage: backups are not stored on the VPS or its underlying host.
  • Disaster-aware: designed to survive host and regional failures.

In practice, this provides the simplicity of snapshot-style recovery without the risk profile of on-server snapshots.

What full-system backups do not do

Full-system backups are intentionally broad. They restore the server as a whole and do not provide file-level or database-level recovery.

Restoring a single file or database table requires rolling the entire VPS back in time, which is often unnecessary and disruptive for routine recovery tasks.

Why multiple backup layers matter

Different failure scenarios require different recovery tools. A layered approach gives you options when things go wrong.

A good backup plan is not only about accidental deletion. It also covers ransomware, compromised credentials, failed deployments, and regional infrastructure outages.
  • Regional outage: backups must exist outside the hosting environment.
  • Security incident: backups should not be easy to delete from the VPS.
  • Granular recovery: files and databases should be restorable independently.
  • Long retention: older restore points should exist beyond snapshot schedules.

Common backup layers that work well together

1) Full-system backups (baseline)

These protect the entire VPS and provide the fastest path back to a known-good server state.

2) Independent off-site backups (SaaS)

Off-site backup services store your data outside the hosting environment and usually support file-level and database-level recovery. This layer is great when you want a managed experience: dashboards, change tracking, and simpler restores.

One example is CodeGuard. There are many others. Choose tools that support off-site storage, reasonable retention, and practical restores.

Choose “independent” on purpose: If your hosting account, VPS, or credentials are compromised, your off-site backups should still be safe and recoverable.

3) Application-aware backups

CMS-aware tools back up application data separately from the server. This makes restoring a database or asset set faster and less disruptive.

  • ExpressionEngine: Safe Harbor
  • Craft CMS: Enupal Backup
  • WordPress: plugins or external services layered with host-level backups

These are third-party tools. Arcustech does not operate or endorse a specific vendor.

4) DIY off-site backups (CLI tools + object storage)

If you want full control, a common approach is a CLI backup tool that pushes encrypted backups to object storage outside your VPS environment.

One popular option is restic, which creates encrypted, deduplicated backups and supports common backends including S3-compatible storage.

For storage, many teams use S3-type services such as AWS S3, Backblaze B2, Wasabi, and other S3-compatible providers. The key is not only “off-site,” but also hard to delete if the VPS gets compromised.

Threat model to plan for: If an attacker gains access to your VPS, they may be able to run your backup tool and delete backups from your storage bucket. Reduce this risk by using storage features like versioning and immutability (Object Lock), and by separating backup credentials from day-to-day server credentials.

Make off-site backups resilient against deletion

  • Enable bucket versioning: helps you recover from accidental overwrites and many “delete everything” events by retaining older versions.
  • Use immutability (Object Lock / retention): lock backup objects for a retention period so they cannot be permanently deleted until that time passes.
  • Limit backup credentials: create a dedicated bucket user with the minimum access needed. Avoid using broad “admin” keys on a VPS.
  • Keep a second, truly independent layer: for higher-risk workloads, consider a second destination, a second account, or replication to a separate provider.

You do not need every option for every site. The point is to make sure one compromised system does not have the power to erase your recovery path.

Common mistake: Backups stored on the same server are not backups. Files written to the VPS do not protect against server loss, disk failure, ransomware, or data center outages.

What to test at least once

  • Restore a full-system backup to a temporary or staging VPS.
  • Verify key application workflows.
  • Test file-level or database-level restores separately.
  • Document the steps so recovery is repeatable.
Bonus test: Make sure you can still restore even if the VPS is compromised. This is where “independent” backups (and immutability features) prove their value.

Next steps

Backup strategies vary by application and workflow. Review CMS best practices, then layer application-level backups with off-server full-system backups.

Gen5 backup options Contact our team

If you have questions about how Arcustech full-system backups fit into your strategy, our team is happy to clarify.

Back to Articles