Backups

Reqad backs up whole hosting accounts - files, databases, mail, web and PHP configuration, SSL certificates, cron jobs and the DNS zone - and restores them with the same user, password and settings. Backups can be taken by hand and kept on the server, or sent every night to a separate backup server over SSH. Exclusion rules decide what is left out.

Keep backups off the server. A backup stored on the VPS it protects is lost together with that VPS. Use nightly remote backups for disaster recovery, and local backups for one-off copies.

Everything below is under Backup in the panel, which has three tabs:

TabWhat it is for
Remote backupThe backup server, the nightly schedule, and restoring from what is stored there.
Local backupBack up one account now, download the archive, or restore an account from one.
ExclusionsWhat every backup leaves out: mounted filesystems, caches, folders, files and databases.

What a backup contains

Each account is one .tar.gz archive with a single backup-<user>/ folder inside:

PartContents
WebsiteThe home directory (without mail/), the nginx or Apache vhost and the PHP-FPM pool, SSL certificates, the account's cron jobs, the system user (uid, gid, password hash) and the full DNS zone.
EmailThe mail/ folder with every mailbox, the mail and forwarder settings, DKIM keys, mailbox passwords, filters, autoresponders and the mail DNS records (MX, SPF, DKIM, DMARC).
DatabasesA dump of every database the account owns, the CREATE DATABASE statements and the database users with their grants.

The archive also holds summary.txt (the web stack and software versions it was taken on) and, when anything was left out, excludes.txt - see Exclusions.

Treat archives as sensitive. They contain password hashes for the system user, the mailboxes and the database users, and the SSL private keys.

Local backups

  1. Open Backup → Local backup and click Generate backup.
  2. Choose the account.
  3. Tick what to include: Website, Email, Databases - any combination.
  4. Optionally tick Ignore exclusions (full copy) to back up everything the exclusion rules and .nobackup markers would leave out. Filesystems mounted inside the home directory are still skipped while that setting is on.

The backup runs in the background and appears in the list as backup in progress until it is done. Archives are written to /usr/local/reqad/backup/ as backup_<user>_<date>.tar.gz, where they can be downloaded or deleted.

Restore an account from a local backup

  1. Put the archive in /usr/local/reqad/backup/ (archives made on this server are already there).
  2. Click Restore account and pick the archive.

The restore recreates the system user with its original uid and password, the home directory, databases and grants, mailboxes, web and PHP configuration, SSL certificates, cron jobs and the DNS zone at your configured DNS provider. It runs in the background and the page shows the result when it finishes. Let's Encrypt certificates are restored as they were and then re-issued in the background, so automatic renewal keeps working.

A restore only creates an account that does not exist. If the user, its uid or its domain is already on the server, it stops without changing anything - delete the account first to roll it back.

Nightly remote backups

The nightly backup sends every account, one after another, to a backup server over SSH. Archives are streamed straight into the connection, so the server being backed up never needs free space for a copy of its own data. Large databases are dumped straight to the backup server in the same way.

Set up the backup server

On Backup → Remote backup, click Configure on the Backup server card:

FieldMeaning
ServerHost name or IP of the backup server.
SSH userThe account backups are written as. A dedicated user per server keeps servers apart.
PortIts SSH port. If csf is installed, Reqad opens it for outgoing connections.
Private keyOptional path to the key root uses to log in, e.g. /root/.ssh/backup. The backup server must accept it without a password.
Remote directoryOptional. Defaults to the SSH user's home directory.
Stream databases overDatabases at least this many MB (default 1024) are dumped straight to the backup server instead of into the account archive.

Save and test checks the connection and shows where backups will go.

Schedule and retention

The Nightly backup card sets the time of the run, switches it on or off, and sets how many backups to Keep (1-9). Each step up keeps one more backup, spread out over time:

  1. the newest backup
  2. the 2nd newest
  3. the 1st of this month
  4. the 15th of this month
  5. the 1st of last month
  6. the 3rd newest
  7. the 15th of last month
  8. the 4th newest
  9. the 1st of the month before last

Old backups are only removed after a run that finished without errors. Notify on errors emails the contact address from Settings when a run fails. It is on by default once a contact address is set.

Each run creates one dated folder on the backup server:

<remote directory>/2026-10-01/
    accounts/<user>.tar.gz          one per account
    accounts/<user>.index           what that archive holds
    databases/<user>/<db>.sql.gz    databases over the size limit
    system/                         /etc, cron, DNS data, panel state
    MANIFEST.txt

Restore from a remote backup

Click a date on the Remote backup tab to see its accounts, then Restore on an account. What can be restored depends on whether the account still exists:

OptionWhenWhat it does
The entire accountThe account was deletedRecreates the user, home directory, databases, mail, DNS and SSL, like a local restore.
public_html onlyThe account existsStreams the website files back. Replace, don't merge first moves the current files to public_html.prerestore-<date>, so the result is exactly the backup.
One databaseThe account existsImports one database. Drop and recreate first removes tables created since the backup.

Restore entire server rebuilds a whole server from one date: the panel's own data, every account and, optionally, the system files in /etc. It is only offered on a freshly installed server with no accounts yet.

Test the nightly backup from the command line

See what tonight's run would back up and leave out for one account, without sending anything:

/usr/local/reqad/scripts/backup_remote.sh --user bob \
    --no-system --dry-run

Back up that one account for real, into a separate folder on the backup server so the nightly backups are not touched:

/usr/local/reqad/scripts/backup_remote.sh --user bob \
    --no-system --no-notify --dest reqad-test

Run both as root. backup_remote.sh --help lists every option.

Exclusions

Backup → Exclusions decides what backups leave out: things that can be rebuilt (caches, node_modules), things that are already backed up elsewhere (archives of old sites, backup plugins' own copies) and things that are not part of the account at all (a network share mounted in the home directory).

Global settings

Three switches apply to every account. They save as soon as they are flipped.

SwitchDefaultWhat it does
Skip folders holding a .nobackup fileOnAn empty file named .nobackup leaves the contents of its folder out of every backup; the folder itself is kept. Account users can set it over SFTP, without the panel.
Skip filesystems mounted inside a home directoryOnsshfs, NFS, CIFS or another disk mounted under /home/<user> is left out. Mounts are read from the mount table, never walked, so an unreachable network share cannot stall the backup.
Skip cache folders marked with CACHEDIR.TAGOffLeaves out folders carrying the standard cache marker many tools write into folders they can rebuild.
touch ~/public_html/videos/.nobackup

Rules added under Global settings apply to every account.

Individual account settings

Choose an account to see its own rules together with the global ones. Each rule has:

  • Type - Files / folders takes a pattern; Database picks one of the account's databases. An excluded database is still created on restore - empty, with its users and grants - only its data is left out.
  • Applies to - Nightly + manual, Nightly only or Manual only. For example, leave a large media folder out of the nightly backup but keep it in a manual copy.
  • Note - optional, for whoever reads the rule later.

Three buttons help decide what to exclude:

ButtonWhat it does
Calculate sizesShows how much each rule matches right now, a few of the matching paths, the folders left out by marker files, and roughly how much the nightly and the manual backup leave out.
Find things to excludeLooks for node_modules, WordPress page caches, backup-plugin folders (UpdraftPlus, All-in-One WP Migration, Duplicator, WPvivid), ~/.cache, archives and dumps over 50 MB, error_log files and core dumps. Each suggestion shows its size and is added with one click. Mail folders are not searched.
Import cpbackup-exclude.confShown when the home directory has a cpbackup-exclude.conf file. Each line becomes a rule; lines outside the home directory are skipped.

How patterns work

Patterns work like .gitignore and are always relative to the account's home directory:

PatternMatches
node_modulesNo slash: a file or folder with that name at any depth.
/tmpLeading slash: only ~/tmp, not ~/public_html/tmp.
public_html/cacheA slash inside: only that path, from the home directory.
**/wp-content/cacheLeading **/: that path at any depth.
*.log, backup-*.zip*, ? and [abc] are wildcards. * also crosses folders.

A matching folder is left out with everything in it. Patterns cannot reach outside the home directory, and cannot touch the account settings, database dumps and mail configuration the backup stores next to it. * on its own, .., quotes and $ are refused.

Examples

PatternLeaves out
/backupThe ~/backup folder only.
node_modulesEvery node_modules folder - reinstall with npm install.
**/wp-content/cacheThe page cache of every WordPress site in the account.
public_html/wp-content/updraftUpdraftPlus's own backups of the main site.
*.logEvery file ending in .log, anywhere.
error_logPHP error logs in every folder.
public_html/*.zipZip files anywhere under public_html (* crosses folders).
mail/*/.TrashThe Trash folder of every mailbox.
mail/*/.Trash*Trash and its subfolders (a subfolder Old of Trash is stored as .Trash.Old, next to it).
mail/*/.JunkThe Junk folder of every mailbox.

Check a new rule with Calculate sizes before the next backup: it shows what the rule matches.

Restoring a backup that has exclusions

Everything a backup left out is listed in excludes.txt inside the archive, and the Remote backup tab shows an excluded badge on those accounts. When the archive is restored:

  • the restore ends with a list of what was not in the backup, so a missing node_modules is not mistaken for a broken restore;
  • mount points are recreated as empty folders, ready to mount again;
  • excluded databases are created empty, with their users and grants;
  • the account's own exclusion rules come back with it.

Migrating in

Coming from cPanel? The Transfer Tool pulls domains, PHP settings and databases from a remote cPanel server over SSH.


Need a hand? Create a free account or contact us.