Backup and restore

A backup is one ZIP file with your whole shop: products, stock, sales, payments, purchases, customers, users and roles, settings, the activity log and, if you choose, the pictures (logo, product images and customer-display pictures). You can download it, keep it somewhere safe, and restore it later on the same server or on a new one.

Backups are in Settings → System & demo → Backups. Only a Super Admin can use them unless you give the backups permissions to another role in Users and roles. Backups are not available while demo mode is on.

#Create a backup

1. Go to Settings → System & demo and scroll to Backups.
2. Under Create a backup now, leave Include pictures ticked (untick it for a smaller file).
3. Optionally type a Password twice. The file is then encrypted (AES-256) and cannot be restored without it.
4. Click Create backup. The new file appears under Saved backups.
5. Click Download and keep the file somewhere other than the server: your computer, a USB drive or a cloud drive.

Warning: A backup holds every customer's details and every user's password hash. Keep downloaded files private. If you set a password, write it down: nobody can open the backup without it.

Tip: Backups saved on the server do not help if the server itself is lost. Download one regularly. The page reminds you when you have not downloaded a backup for 7 days.

#Automatic backups every night

A new install makes a backup every night at 02:00 and keeps the last 7 automatic backups. Older automatic backups are removed; backups you made yourself are never removed automatically.

1. Under Automatic backup, tick or untick Make a backup every night.
2. Choose the hour in At and how many to Keep.
3. Click Save.

Automatic backups need the Laravel scheduler cron on the server (see Add the cron job):

* * * * * cd /path/to/posmaster && php artisan schedule:run >> /dev/null 2>&1

If no automatic backup has run for 2 days, a yellow note on the Backups card says so. Usually the cron is missing.

#Restore a backup

Restoring replaces all current data with the backup.

1. In Saved backups, click Restore on the backup. To restore a file from your computer, choose it under Restore from a file and click Upload and check.
2. The check page shows what is inside: the date, who made it, the POSMaster version and the number of products, customers, sales, purchases and users.
3. If the backup has a password, type it in Backup password.
4. Type your current password, type RESTORE in capital letters, and click Restore this backup.

What happens:

• A safety backup of the current data is made first (type Before restore in the list), so you can go back.
• Other users see a short "Back in a minute" page while it runs.
• If anything goes wrong during the restore, the safety backup is put back automatically and you see an error.
• Everyone is signed out. Sign in again with an account that is in the backup (its password is the one it had when the backup was made).

#Older and newer backups

• A backup made with an older POSMaster is restored and then upgraded automatically, the same way an update would.
• A backup made with a newer POSMaster cannot be restored. Update POSMaster first.

#Moving to a new server

1. On the old server, create a backup with pictures and download it.
2. Install POSMaster on the new server (a clean shop is fine: see Install on web hosting).
3. Sign in as the Super Admin of the new install, upload the backup and restore it.
4. Sign in with your usual account from the old server.
5. Enter the SMTP password again in Settings → Email: it is encrypted with each server's own key, so it cannot move with the backup.

#Large shops and the command line

On shared hosting PHP may only run for 30 seconds. A very large shop may not finish a backup or restore from the browser. Use the command line instead, or rely on the nightly backup that the cron runs:

php artisan pos:backup                  # with pictures
php artisan pos:backup --no-files       # database only
php artisan pos:backup --password=Secret123
php artisan pos:restore POSMaster-backup-my-shop-2026-10-20-0200-auto.zip

With Docker, run them as docker compose exec -u www-data app php artisan pos:backup.

Uploads are limited by the server's upload_max_filesize; the page shows the limit. For a bigger file, copy it into storage/app/private/backups with FTP or the hosting file manager: it then appears in Saved backups.

#Questions

Where are the files? In storage/app/private/backups on the server. This folder is not reachable from the web; downloads go through the app and need the backups.view permission. You can change the folder with POS_BACKUP_DIR in .env.

What is left out? Sign-in sessions, cache, queued jobs and password-reset links (temporary data), the .env file, logs and earlier backups.

Is it safe to restore a file someone sent me? The file is checked before anything changes: every part must match its checksum, only data rows and pictures are accepted, and no SQL from the file is ever run. Pictures that contain scripts are not restored. Still, only restore backups from people you trust: a restore replaces all users and passwords.