Backups

For: owners protecting their data. Where: Settings > Backups, or navigate to /settings/backups.

Creating a backup

The Create Backup section has one optional field:

• Passphrase (optional): encrypt the backup with a passphrase. You will need this passphrase to restore.

Click Create Backup Now. InvoiceScript creates a ZIP file containing your database and uploaded files (logos, media). The backup is stored in storage/backups/ on your server.

Existing backups

The Existing Backups section lists all backup files with their creation date and file size.

For each backup:

• Download: download the ZIP file to your local machine
• Delete: remove the backup file from the server

When no backups exist, the section shows: "No backups yet. Create your first backup to protect your data."

Scheduled backups

The Scheduled Backups section configures automatic backup creation.

Scheduled backups require a cron job running php artisan schedule:run every minute on your server. Without cron, scheduled backups do not fire.

Click Save Settings to apply.

What backups include

Each backup ZIP contains:

• Database: a full copy of your database (SQLite file copy or MySQL dump)
• Media files: everything in storage/app/private/ and storage/app/public/ (uploaded files, logos, attachments)
• Manifest: metadata including creation date, database driver, app version, and PHP version

What backups do not include

• Application code (PHP files, templates, assets)
• Server configuration (Apache/Nginx, PHP settings)
• .env file (your configuration secrets)

To fully restore InvoiceScript, you need both the application code (from the release ZIP) and a backup of your data.

Downloading backups

Click Download next to a backup in the list. The ZIP file downloads to your local machine.

Keep downloaded backups in a secure location separate from your server (external drive, cloud storage, or a different server). Backup files contain the entire database — treat them with the same sensitivity as the database itself.

Restoring from a backup

[!CAUTION] Restoring a backup replaces your current database and media files. This cannot be undone unless you create a backup first. After restore, your current session is invalidated — you will need to sign in again.

To restore:

1. In the Restore from Backup section, select a backup from the dropdown
2. If the backup is encrypted, enter the passphrase
3. Type your email address to confirm the restore
4. Click Restore Backup

InvoiceScript automatically creates a pre-restore safety backup before replacing your data. It also enters maintenance mode during the restore so visitors see a maintenance page.

Restore risks

• All data created after the selected backup was made is lost
• User accounts revert to the backup state — users added after the backup will not exist
• Your current session is invalidated and you will be redirected to the sign-in page
• If the backup was encrypted and you lost the passphrase, the restore fails
• Settings, invoice numbers, payment records, and audit logs revert to the backup state

How to test restore safely

Do not test restore on your live production installation. Use a disposable copy instead:

1. Copy your entire InvoiceScript installation to a separate directory or staging subdomain
2. Copy the .env file and update DB_DATABASE to point to a separate copy of the database — do not reuse the production database connection. For SQLite, copy the .sqlite file to the new directory. For MySQL, create a new database and import a dump of the production data.
3. Copy the storage/ directory so uploaded files are included in the test
4. In the copy, create a backup via Settings > Backups
5. Make a small change in the copy (e.g., edit the company name)
6. Restore from the backup you created in step 4
7. Verify the company name reverted — the restore works correctly
8. Delete the disposable copy (directory, database, and any staging DNS) when you are done

[!CAUTION] The staging copy must use its own database and storage. Reusing the production .env without changing DB_DATABASE will point the staging copy at your live data.

If you cannot create a staging copy, use a fresh local install with demo data to verify the restore workflow. Never test restore on a production installation that contains real business data.

Encryption

Backups can be encrypted with a passphrase using AES-256 encryption inside the ZIP file. If you use encryption:

• Store the passphrase securely — without it, the backup cannot be restored
• Encrypted backups require the passphrase during restore
• Scheduled backups do not use encryption by default. Use the CLI command with --passphrase for encrypted scheduled backups

Shared-hosting permissions

The storage/backups/ directory must be writable by the web server. On most shared hosts, permissions of 755 or 775 work. If backups fail with a permission error, check the directory permissions through your hosting control panel.

Permissions

Only the owner role can create, download, restore, and delete backups. Backup files contain the entire database — they are the most sensitive artifact in the system.

Related pages

• Manage Backups
• CLI Commands