Keep no backups on the server they protect
A backup on the same disk dies with that disk. How one hosting server moved 431 backups off-site and freed half its disk without losing a restore.
The disk that held its own backups
Our own hosting server, web.revoza.co.il, was 84% full in October. Backups took 79 GB of its 162 GB used. Each site kept seven full copies, and copies of deleted sites stayed forever.
All of it sat on the disk it was meant to protect. One failed disk would have taken every site and every backup at the same moment.
Three ways to keep a backup
KLYRN Web now keeps backups in one of three modes. Local keeps them on the server. Local and remote keeps both. Remote only sends each backup away and keeps nothing behind.
The destination is an SFTP server or any S3-compatible bucket you control. For SFTP, the panel makes its own key and pins the server's host key, so a swapped server is refused.
Delete the local copy only after the upload is checked
A copy that failed halfway is worse than none, because it looks like a backup. So the local file is removed only after the upload is verified.
The panel checks the size at the destination, and can read the file back and compare its SHA-256. If either check fails, the local copy stays and the upload is tried again.
Moving the backups you already have
Turning the mode on covers new backups. Existing ones move with one action, Move existing backups, through the same verified queue.
On our server that moved 431 backups, 82 GB, and every one was checked at the destination. Disk use fell from 162 GB to 72 GB.
A backup you have not restored is a guess
We fetched one remote backup back to the server and compared it with its manifest. The SHA-256 matched. After the switch, nine scheduled runs finished unattended, each verified off-site and freed locally.
Test a restore yourself once a month. Pick a small site, restore it under a staging name and open it.
The backup server itself
Give the panel its own user on the backup server, locked to SFTP in its own folder with no shell. Then a stolen panel key reaches only that folder.
The backups guide covers schedules, keys and restores. The disaster recovery guide covers rebuilding a lost server.