Strapi Remote Backup Pro, backing up a Strapi CMS without installing anything in it

Every Strapi backup tool we looked at is a plugin. Installing one means adding a dependency to a live CMS, redeploying it, and trusting code that runs inside the production process. If you are an agency backing up a client's site, you may not have deploy access at all.

Strapi Remote Backup Pro works from outside. You point it at the CMS URL and sign in as an admin, and it talks to the same admin API the Strapi admin panel uses. Nothing is installed, so nothing has to be redeployed or removed afterwards, and it cannot destabilise a CMS it is not running inside. It is in development, and this post says how far it has got.

What works today

The engine and the command line, published on npm as 0.1.0. The commands are login, backup, restore, inspect and verify.

npx @tech-style/strapi-remote-backup-pro backup --url https://cms.example.com --email admin@example.com

It needs Node.js 22.19 or later. If you would rather not deal with Node, a bootstrap installer stages a pinned, checksum-verified runtime and puts a strapi-backup command on the PATH. That installer has been measured working on Windows and has not yet been run on macOS or Linux.

The round trip is proved on Strapi v5: backups have been restored repeatedly between two live Strapi 5.52.0 instances and compared record by record.

What a backup holds

Content entries across collection and single types, drafts and published, in every locale. The media library with its folder structure. Content-type and component schemas as they stood at backup time.

The archive is a plain .zip that any operating system can open:

backup-2026-08-18T1430.zip
├── manifest.json            always plaintext, always first
├── schemas/                 content types and components
├── content/
│   └── api--article.article.ndjson   one JSON record per line
├── media/
│   ├── media.ndjson         filenames, folder paths, hashes
│   └── files/               named by content hash, de-duplicated
└── meta/
    ├── locales.json
    └── run-report.json      counts, durations, warnings

Each entry carries a SHA-256 checksum, and the archive can be encrypted with AES-256-GCM. The manifest is never encrypted, so an archive can be identified without its passphrase. The format is documented in full, so your backups stay readable even if the tool goes away.

Restore shows you the plan first

You pick content types, individual records and how many relation hops to follow. Restoring a few articles brings the authors and categories they point at, so nothing ends up referencing a record that is not there.

Because restore writes to a live CMS, it always produces a diff first: creates, updates, deletes and skips, with warnings about schema drift and relations that would land unresolved. Nothing is written until you confirm.

Built to behave like a guest

It holds admin credentials, so it is careful with them. The password is exchanged once for a session token and dropped. It is never written to disk, to an archive or to a log. Strapi throttles admin sign-in, so a failed sign-in is never retried automatically, because a retry could lock you out of your own CMS. Concurrency is capped low by default and it backs off when rate-limited. A backup should never be the reason a site goes down.

Not built yet

  • Seven of the eight destinations. A local or network folder works today. S3 and the services that speak its API, Azure Blob, Google Drive, Dropbox, OneDrive, SFTP and FTPS are designed behind a provider interface but still throw when called.
  • Scheduled backups as a Windows service or a systemd daemon, including one catch-up run after a machine sleeps through several windows.
  • The desktop app. It is designed and skeletoned in Avalonia, and nothing behind it runs yet.
  • Strapi v4. The v4 dialect is written but has never been run against a v4 instance, so we call it written, not supported. One limit will stay: v4 identifies records only by an instance-local number, so restoring a v4 archive into a different instance needs an explicit identity mapping.

If you have a v4 site that needs backing up, tell us. We would rather prove it against yours than ask you to take our word for it.

Strapi Remote Backup Pro is MIT licensed. It is a Tech Style product: tech-style.co/product-strapi-remote-backup. The source is at github.com/eharain/strapi-remote-backup-pro.

Comments

Post a Comment

Popular posts from this blog

pgrecon, an Oracle to PostgreSQL assessment that never connects to your database

Most Oracle to PostgreSQL projects are priced before anyone has read the code. Someone counts tables and guesses at the PL/SQL, and the expensive surprises turn up late: package-level state, autonomous transactions, LONG columns, interval partitioning, database links. pgrecon is our free, open-source tool for finding those things first. It is on GitHub under Apache 2.0 and on PyPI as pgrecon . It needs Python 3.11 or later. It never connects to your database That matters, because it decides whether a bank or a hospital will let you run the tool at all. pgrecon writes a plain SQL*Plus script, SELECT only, against the dictionary views. The DBA reads it, runs it with a read-only account and hands back a folder of files. Only files cross the boundary. pgrecon script --source-version 19 sqlplus readonly_user@service @pgrecon_extract.sql SCHEMA_NAME pgrecon load dump_dir --db inventory.db pgrecon report --db inventory.db The extracting account needs SELECT_CATALOG_ROLE or the equivalent...
Read more

Paritas, an Oracle-compatible PostgreSQL that tells you where compatibility ends

Image
When a company moves off Oracle, most of the effort goes into converting the code. The part that hurts later is quieter. PostgreSQL is not Oracle, and in places it computes a different answer to the same expression. There is no error at build time and none in test. A pricing query returns a slightly wrong number, and a customer is the one who finds it. Paritas is our answer to that. It is PostgreSQL 18 with an Oracle mode that compiles and runs real PL/SQL: packages, triggers, collections and exceptions. It is still in development and not for sale. This post is mostly about how we test it, because that is the part we think matters. Same code, different answers Here are three cases, each measured on live engines with Oracle Database 21c as the reference. All three convert cleanly. None raises an error you would see at build time. SELECT 3.4e38f * 10f multiplies binary floats past the top of the type. Oracle returns inf . Stock PostgreSQL refuses the literal, and the nearest equiv...
Read more

JSON Compress, lossless JSON compression whose output is still JSON

Image
Send a thousand records over an API and you send a thousand copies of every key name. A status with four possible values is spelled out a thousand times, and so is a currency that is always "GBP". Minifying takes out the whitespace, which is the small part of the problem. The repetition stays. JSON Compress is our open-source library for the repetition. It writes each key name once, turns arrays of like-shaped objects into columns and rows, and stores repeated values once. On record-shaped data the result is typically 45 to 75% smaller than minified JSON, and it comes back byte for byte. The output is still JSON, so it goes wherever the original went: an HTTP body, a WebSocket frame, a Postgres jsonb column, a queue message. What it does to a document There are four transformations, and each can be turned off: A key catalogue. Every distinct key name is written once and replaced by a short token, with the busiest key getting the shortest one. Columnar tables. An array...
Read more