What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The best Linux VPS backup strategy in 2026 is layered 3-2-1 protection: keep provider snapshots for quick rollback, maintain an encrypted and deduplicated Restic or Borg repository outside the VPS provider’s failure domain, and keep a separately controlled or offline copy for irreplaceable data. A snapshot alone is not a disaster-recovery plan because it can disappear with your provider account, region, or retention window.
For most VPSs, Restic is the simplest default when you want S3-compatible or other cloud object storage. Borg is an excellent alternative for a small-memory VPS that can reach an SSH backup host. Whichever tool you choose, schedule it externally, protect its encryption credentials, back up databases consistently, and prove that restores work on a schedule.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What “best backup” means for a Linux VPS
A backup plan is successful only when it can restore the service after the original VPS, its disk, or its provider account is unavailable. That requirement changes the design. A local archive, a second directory on the same disk, or a provider snapshot may help with a mistaken update, but none is sufficient protection against account lockout, provider failure, ransomware, accidental deletion, or a damaged region.
Design the plan around three objectives:
- Recovery-point objective (RPO): how much data you can afford to lose. Daily backups may be adequate for a low-change server; a busy game server, shop, or database may need hourly runs.
- Recovery-time objective (RTO): how quickly the service must return. Snapshots are usually faster for rollback, while an off-site rebuild takes longer but survives provider-level incidents.
- Independence: at least one usable copy must remain available if the VPS account, provider, region, or primary storage location is gone.
There is no provider-independent failure-rate, recovery-time, or universal cost figure for all Linux VPS companies. Snapshot retention, geographic placement, export options, and restore speed are provider-specific, so verify those terms before counting snapshots as a recovery layer.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The 3-2-1 architecture
The planning rule is three copies, on two different media types, with one copy off-site. Apply it as three deliberately different layers rather than as three identical folders.
| Layer | Purpose | Typical implementation | What to verify |
|---|---|---|---|
| 1. Fast rollback | Undo a bad package update, deployment, or configuration change within minutes. | Provider snapshots at a cadence appropriate to the VPS. | Retention period, geographic placement, export capability, restore procedure, and account-recovery terms. |
| 2. Independent online backup | Recover after disk loss, a compromised VPS, or a provider-side incident. | Scheduled, encrypted, deduplicated Restic or Borg repository outside the provider’s failure domain. | Repository credentials, storage durability, deletion controls, monitoring, and a tested restore. |
| 3. Separately controlled or offline copy | Survive deletion of the online repository, credential compromise, or a provider account disappearing. | Replicated selected snapshots to another provider, a removable external drive, or another independently administered medium. | Rotation, write protection or disconnection when practical, encryption, and the ability to restore without the VPS account. |
Keep the layers operationally separate. A snapshot stored by the same provider as the VPS is useful, but it shares the provider’s account and failure domain. An object-storage repository managed with the same credentials may also be deleted by an attacker. The third layer should therefore use a different account, administrator, provider, or physical medium.
Are VPS provider snapshots enough?
No. A snapshot is a rollback convenience, not proof of disaster recovery. It can be the fastest way to return to a known-good disk image after a failed kernel update, bad firewall rule, or broken deployment, but it may not help when:
- the provider account is suspended, lost, or inaccessible;
- the provider suffers a regional or platform-wide outage;
- the snapshot retention window has expired;
- the provider does not let you export the snapshot to an independent location;
- the snapshot captures an inconsistent live database;
- an attacker with account access deletes both the VPS and its snapshots.
Enable snapshots on a schedule that matches the rollback window, then test creating a fresh VPS from one. Confirm whether snapshots are encrypted, where they are stored, how long they are retained, whether they can be copied to another region, and what support can do if the billing or identity account is unavailable. Keep application-level backups regardless.
Restic or Borg: which should you choose?
Both tools create incremental, deduplicated archives and can protect a Linux VPS when configured correctly. The deciding factor is usually the storage target and the VPS’s resource limits.
| Decision axis | Restic | Borg |
|---|---|---|
| Encryption | Repository encryption and authentication are part of the design. | Client-side authenticated encryption is supported; the encryption mode is configurable. |
| Storage targets | Broad official backend support, including S3-compatible storage, Backblaze B2, Azure Blob, Google Cloud Storage, SFTP, and REST. | Commonly stores on an SSH-accessible remote host. |
| Scheduling | Requires an external scheduler such as systemd, cron, or a wrapper. | Also relies on an external scheduler or wrapper; the archive tool is not a built-in daemon. |
| Resource profile | Good general-purpose choice when cloud backends and portable binaries matter. | Mature and memory-efficient, making it attractive on small VPSs. |
| Main operational risk | Someone with write access can delete or manipulate repository data; the threat model does not promise protection against that. Use append-only or storage-level deletion protection where available. | Protect the repository and encryption key, and separate SSH access and deletion permissions where possible. |
Choose Restic when object storage is the priority
Restic is usually the simpler starting point when you want to send backups directly to S3-compatible storage or a major cloud object store. It runs as a command-line client, encrypts before data leaves the VPS, deduplicates repeated content, and can also use SFTP or a REST server. You still need to operate the repository, schedule jobs, monitor failures, and control who can delete objects.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteChoose Borg when an SSH backup host is simpler
Borg fits a design with a dedicated Linux backup host reachable over SSH. Its content-defined chunking, optional compression, client-side encryption, and integrity verification can be efficient on a constrained VPS. The remote host must be administered as carefully as the VPS: an SSH account with unrestricted deletion rights can erase the repository.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Build an encrypted Restic backup
1. Prepare an independent destination
Create a bucket, SFTP account, or REST endpoint that is not on the VPS itself. Put it in a different failure domain when practical. Give the backup identity only the permissions it needs. Prefer an append-only policy, object lock, retention lock, or an equivalent deletion control if the storage service offers one.
Record the repository location and encryption password in two separate places: a password manager and an offline escrow. The password is not recoverable from the encrypted repository. If it is lost, the data may be permanently unreadable.
2. Initialize the repository
Install a current Restic package appropriate for your distribution, set the repository endpoint and password-file variables, and initialize the repository once. A representative environment setup is:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →export RESTIC_REPOSITORY='s3:https://object-storage.example/your-bucket/vps-01'
export RESTIC_PASSWORD_FILE='/root/.config/restic/password'
restic initUse the backend syntax documented by your chosen storage service. Keep the password file readable only by root (for example, mode 600), and do not place the password in a world-readable unit file, shell history, or ticket.
3. Back up rebuild-critical data
Include the files needed to recreate the host, not merely the largest directories:
- application source, deployment manifests, and service definitions;
/etcfiles for services, firewall rules, users, timers, and mounts;- TLS certificates and private keys, with access controls preserved;
- user-uploaded assets, game worlds, save files, and media;
- secret material required to reconnect deployments and external services;
- package lists, custom scripts, and documented infrastructure configuration.
Exclude caches, temporary files, dependency directories that can be rebuilt, and mounted paths that would create an accidental recursive backup. Maintain an explicit include and exclude list so a future administrator knows what was intentional.
4. Dump databases consistently
Do not assume that copying a live PostgreSQL, MySQL, or other database directory produces a recoverable point-in-time backup. Use the database’s consistency-aware dump or backup mechanism, write the dump to a protected staging directory, then include that dump in the Restic run. Clean up old staging dumps only after a successful backup and according to your retention policy.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
5. Run a first backup and verify it
restic backup /etc /srv/apps /srv/game-data /var/backups/database-dumps
restic snapshots
restic checkThe exact paths depend on your application. Review the snapshot list, inspect the reported file count and size, and treat a failed command as a failed backup. Alert on non-zero exit status rather than relying on a dashboard that only shows the last attempted run.
Scheduling, overlap control, and retention
Restic does not schedule itself. Use a systemd service and timer, cron, or a wrapper that records logs and exits clearly. A daily run is a reasonable baseline for ordinary VPS workloads; increase the frequency when the RPO demands it.
A systemd design separates the one-shot backup command from its calendar:
[Unit]
Description=Restic VPS backup
[Service]
Type=oneshot
EnvironmentFile=/etc/restic/vps.env
ExecStart=/usr/bin/restic backup /etc /srv/apps /srv/game-data /var/backups/database-dumps
[Unit]
Description=Run Restic VPS backup daily
[Timer]
OnCalendar=*-*-* 02:15:00
Persistent=true
[Install]
WantedBy=timers.target
Use a lock or wrapper so a slow run cannot overlap the next one. An overlap can waste resources, produce confusing logs, and contend with database dump jobs. Add a timeout appropriate to your dataset, but do not kill a job so aggressively that every large backup is incomplete.
Tag snapshots by host or workload and document retention. One practical pattern is enough daily points for recent mistakes, weekly points for several weeks, and monthly points for delayed corruption or compromise. Apply pruning only after confirming that the repository contains the points you intend to keep:
restic forget --keep-daily 7 --keep-weekly 5 --keep-monthly 12
restic pruneChange those counts to match your legal, operational, and storage requirements. Retention is not a substitute for a second copy; pruning a single repository still leaves one failure domain.
Operating Borg on a small VPS
With Borg, provision a separate SSH-accessible backup host and a dedicated repository path. Restrict the SSH key to the backup account, disable interactive access where practical, and separate the account that can create archives from any administrator who can delete the repository. Store the Borg encryption key in a password manager and offline escrow.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
borg init --encryption=repokey-blake2 backupuser@backup-host:/srv/borg/vps-01
borg create --stats --compression zstd backupuser@backup-host:/srv/borg/vps-01::{now} /etc /srv/apps /srv/game-data /var/backups/database-dumps
borg list backupuser@backup-host:/srv/borg/vps-01
borg check backupuser@backup-host:/srv/borg/vps-01Confirm that the encryption mode, compression support, and command syntax match the Borg version installed on both sides. Schedule the commands with systemd or cron, capture exit codes, and test extraction to a non-production directory. Borg’s efficiency does not remove the need for independent copies and restore drills.
How often should backups run?
| Workload | Starting cadence | Increase frequency when |
|---|---|---|
| Static site or infrequently changed configuration | Daily file backup plus snapshots before changes. | Deployments are frequent or losing a day’s edits is unacceptable. |
| Game server worlds and user uploads | Daily full policy with more frequent incremental runs during active play. | Players create valuable progress faster than the current RPO. |
| Transactional database | Database-native dumps or continuous mechanisms appropriate to the engine, plus scheduled file backups. | Transactions arrive continuously or point-in-time recovery is required. |
| High-value production service | Hourly or more frequent backups where justified, with a tested rebuild process. | The business impact of data loss exceeds the storage and CPU cost. |
Schedule database dumps before the file backup, and leave enough time for the dump to finish. A backup that runs while its source is changing is not automatically consistent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restore drills: turn backups into evidence
A repository that has never been restored is an assumption. Test a small file restore immediately after setup, then perform periodic rebuild drills on a fresh VPS or isolated machine.
- Prove access: retrieve the storage credentials, repository password, and encryption key without using the original VPS.
- Provision clean infrastructure: create a new host with the required operating system and network access.
- Retrieve the repository: install Restic or Borg, configure the endpoint, and list snapshots.
- Restore a sample: restore one configuration file, one application asset, and one database dump into a temporary path.
- Rebuild services: install dependencies, restore permissions and TLS material, recreate users, and enable service units.
- Validate the application: connect to the database, load representative pages or game worlds, and verify scheduled jobs.
- Record the result: measure time to obtain credentials, provision the host, download data, restore, and reach a working service.
Keep the drill isolated from production and destroy temporary secrets afterward. A file restore confirms that objects are readable; a full rebuild confirms that your documentation, credentials, packages, DNS, firewall rules, and service dependencies are complete.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security controls and common failure modes
Lost encryption password
Keep two protected copies of the Restic password or Borg key: one in a password manager and one in offline escrow. Test that the escrow can actually be read by an authorized recovery person. Never store the only copy on the VPS being protected.
Repository deletion by an attacker
Restic’s threat model explicitly says it is not designed to protect against an attacker deleting or modifying files at the storage location. A stolen write credential can therefore defeat an otherwise well-encrypted repository. Use append-only credentials, object retention or lock policies, separate administrators, and a third copy that the backup account cannot delete.
Same-machine “backup”
Saving an archive on the same VPS protects against some application mistakes but not disk failure, host loss, account suspension, or compromise. Move at least one copy off the machine and verify that the destination is reachable independently.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Silent scheduler failure
Check timer status or cron logs, alert on non-zero exit codes, and monitor the age of the newest successful snapshot. A job that starts but cannot authenticate, fill its destination, or complete a database dump is not a usable backup.
Unusable live database copy
Restore a database dump into a clean instance and run consistency checks. If the application cannot start from the restored data, revise the dump and restore procedure rather than assuming the file archive is adequate.
What if the VPS provider account disappears?
Assume that provider snapshots become unavailable with the account. Your independent Restic or Borg repository should be reachable with credentials stored outside that account, and your third copy should not depend on the same identity system. Keep a written rebuild runbook containing:
- repository locations, encryption credentials, and escrow instructions;
- the operating-system version and package or container requirements;
- DNS, firewall, TLS, database, and service configuration;
- restore commands and the order in which services start;
- contacts authorized to approve a recovery and rotate secrets afterward.
If the storage destination is another provider, verify its account recovery and billing contacts separately. If the third copy is an external drive, rotate it and keep it disconnected or write-protected when practical so a compromised VPS cannot erase it remotely.
A practical 2026 plan for a Linux game VPS
For a typical game server with configuration, world files, player uploads, and a database-backed control panel:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Enable provider snapshots before upgrades and retain enough points to roll back recent deployments.
- Generate a consistent database dump and run Restic daily to S3-compatible storage or another independent backend.
- Run additional backups during peak play or before major world edits when the RPO is tighter than 24 hours.
- Keep seven daily, several weekly, and twelve monthly points, adjusting for storage limits and the time corruption might remain undetected.
- Replicate selected monthly snapshots to a separately controlled account or encrypted external drive.
- Restore a file after the first setup, then rebuild the complete server on a fresh VPS at a documented interval.
- After every drill or real incident, rotate credentials that may have been exposed and update the runbook with the measured recovery time.
Bottom line
Use snapshots for speed, Restic or Borg for independent encrypted history, and a separately controlled or offline copy for survival. Restic is the broad-backend default; Borg is compelling for SSH-based storage and tight memory budgets. The strategy is only real when credentials are escrowed, deletion is constrained, schedules are monitored, databases are backed up consistently, and a clean-machine restore has succeeded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
