SFTP with Installatron and Bitvise

Heads up: This solution has since been retired from the author's own setup. Not because it is broken or flawed — it worked well — but circumstances changed. The guide remains accurate and relevant for anyone in the intended situation.

If you run personal or non-profit websites on shared hosting, you probably already know that Installatron handles backups reasonably well — right up until your site grows large enough that keeping backups on the same host starts eating into your allocated space.

At which point you need somewhere else to put them. This is that somewhere else.

FTP is not the answer. FTP/S is marginally better but still not advisable. WebDAV exists if you enjoy configuring things that were not designed to be easy. The cleaner option is SFTP — encrypted, SSH-based, and straightforward to set up on a Windows machine with Bitvise SSH Server. SFTP is an SSH protocol and is considered secure when properly maintained. FTP is not. That is not a matter of opinion.

This guide covers setting up Bitvise as an SFTP target on a Windows machine and pointing Installatron at it for automated offsite backups.

What You Need

• A Windows machine — physical or virtual, does not matter. A repurposed server works fine.
• Bitvise SSH Server — free for personal use with reasonable limitations.

• 

   See the personal edition FAQ. Commercial licensing is available at $95/year for basic use.
•  
• Installatron running on your webhost — standard on many shared hosting control panels.
• Access to your router for port forwarding.
• A non-default port number. Port 22 is SFTP's default and a magnet for scanners. Pick something else — anything unused on your network. This guide uses 33391 as an example.

Network Setup — Port Forwarding

Before anything else, set up port forwarding on your router to direct your chosen port to the Windows machine running Bitvise. The specifics vary by router — portforward.com has guides for most brands.

Once configured, verify the port is actually open before proceeding. There is no point configuring Bitvise against a closed network path.

Dynamic IP — Worth Addressing Early

If your home internet connection uses a dynamic IP address (most residential connections do), you will need a DNS forwarding service to keep the address resolvable. Several providers offer this free for a single host. Portforward.com covers this as well. Sort it before you go further — discovering it mid-setup is avoidable frustration.

Setting Up Bitvise

Install Bitvise from bitvise.com and configure the following:

Port

Set Bitvise to listen on your forwarded port (33391 in this example). Avoid well-known ports — the full list is on Wikipedia if you need to check for conflicts. Ref: Bitvise connection guide.

Virtual Account

Create a virtual account — not a Windows account. The distinction matters for security. A virtual account is isolated and cannot be used to authenticate against Windows itself. Use a complex, lengthy username and password combination. This account will be accessible from the open internet; treat it accordingly. Something like mysftpaccounttobitvise with a password along the lines of 1FAVbJhZJvDoD2xS53gn97Ied gives the right idea. Ref: Bitvise SFTP configuration guide.

Backup Folder

Create a dedicated folder for backups and point the virtual account's root there. Keep it on a separate drive from the system drive — easier to monitor, easier to manage, and keeps backup data away from anything critical if something goes wrong.

Security

Read the Bitvise securing guide before going live. At minimum, restrict access to the IP address ranges of your webhost. Check the Bitvise activity log regularly — it is informative and will tell you early if something unexpected is attempting to connect.

Windows Firewall

Add an inbound rule in Windows Firewall allowing your chosen port. Start permissive — any protocol, any IP — and tighten once you have confirmed the connection works. Name the rule clearly; a rule called "33391 – Bitvise SFTP" is significantly easier to find six months later than one called "New Inbound Rule 4".

Make notes when you change firewall settings. It is easy to tick a box that seems like a security improvement and then forget about it entirely until connectivity breaks.

Windows Ransomware Protection (Controlled Folder Access)

If Windows Defender's Controlled Folder Access is enabled, it will block Bitvise from writing to the file system. You will need to explicitly allow the Bitvise service as a permitted application. This is another reason to use a dedicated backup folder on a dedicated drive — it makes the exception scope clean and obvious. Ref: Microsoft — Controlled Folder Access.

Configuring Installatron

In the Installatron backup interface, you will need five things. Be precise — spaces and

• Address — hostname or IP of your Bitvise machine
• Port — your forwarded port (33391)
• Username — your Bitvise virtual account username
• Password — the corresponding password
• Path — the backup folder path; forward and backward slashes are both accepted

Save each step in Installatron before moving to the next. It does not always retain unsaved changes when you navigate away. Run a manual backup first and confirm files actually appear at the destination before trusting the scheduled automation.

Backup files are stored as .gz archives — Linux compression, but readable and extractable on Windows with WinRAR or 7-Zip.

FAQ

Will this use up my host's bandwidth allowance?

Yes. Backup transfers count against your hosting bandwidth. Several hundred GB in a week is not implausible for larger sites. Check your hosting agreement before enabling scheduled backups.

Connection works but no files are appearing at the backup location.

Check Windows Firewall first. If Controlled Folder Access (Ransomware Protection) is enabled, it may be blocking the Bitvise service from writing. Also verify the virtual account has write access to the target folder root.

Multiple Installatron instances are all writing to the same folder despite different paths being set.

On some hosting control panels (DirectAdmin in particular), the active domain context matters when configuring Installatron backup settings. Make sure the correct domain is selected in the control panel before touching the backup configuration for that site — even if all sites appear in a single list.

Installatron reset the backup destination back to the webhost by itself.

Usually indicates the backup encountered an error, or the connection was never properly tested after setup. Check whether any files were created at the SFTP destination, and check adjacent folders. Also verify you are not accumulating unexpected backups on the webhost and consuming space you had not planned for. Starting fresh with that site's backup config is often the quickest resolution.

How do I restore from these backups?

If Installatron can locate and recognise the backup package directly from the SFTP path, restoration is straightforward. If not, upload the archive to a folder on the host and unpack it there, then point Installatron at the existing backup in its default local folder. Worst case — manual database restore and file upload. If you have any experience managing web applications, you already know how that works.

The author of this text is not affiliated with Bitvise, Installatron, or any other product mentioned.