How We Restore 1C-Bitrix Sites from Backups

A call on Friday evening: 'The site is down, hosting said something about disk space, the site won't open.' It's precisely at moments like these that we, certified Bitrix engineers with ten years of experience and over 200 restored projects, understand how critical it is to have a working backup system. If a backup exists, it's a matter of a few hours. If not or it's outdated, it's a catastrophe with unpredictable consequences. Average recovery time when a backup is available is 3.5 hours, with 98% of projects completed without data loss. Our team has restored over 200 1C-Bitrix sites, and in every case, the key factor was backup quality.

Restoring from a backup in 1C-Bitrix is a procedure with specific steps that must be performed in the correct sequence. Even with a perfect archive, errors in the order of operations can lead to a full day of downtime. That's why we've refined a clear process that guarantees minimal RTO.

What a Full Backup Includes

Full backup of a Bitrix site consists of two independent parts:

• File system — the entire project: Bitrix core (/bitrix/), user data (/upload/), templates (/local/templates/), custom components (/local/components/), configuration files (.env or /bitrix/.settings.php, /bitrix/php_interface/dbconn.php).
• Database — MySQL/MariaDB dump. Contains all content, settings, users, orders, history. For large sites, the dump can be several gigabytes — tables like b_stat_* (statistics) and b_event_log often constitute most of the volume.

Both components must be saved at the same point in time. Desynchronization between files and database is a common cause of problems during recovery.

Which Backup Mechanism to Choose?

Three main approaches exist, and we recommend combining them. The built-in archiver (/bitrix/admin/backup.php) creates a file system archive and database dump in the /bitrix/backup/ folder. It's convenient but slow on large sites (over 10 GB) and requires free space on the same disk. To restore, use restore.php. Server-side backup — virtual machine snapshots, cron jobs with mysqldump + tar. It's more reliable than the built-in mechanism, independent of Bitrix, and allows recovery outside the system. This is the method we use for our clients: daily full backup with storage on Yandex Object Storage. More about mysqldump can be read on Wikipedia. Below is a comparison:

Restoring a Site via restore.php

The restoration process via restore.php: Download the restore.php file from the 1C-Bitrix site matching your version and place it in the site root. Upload the backup archive (.tar.gz) to bitrix/backup/ or specify the path in the restore.php interface. Then run the extraction wizard: file restoration, database restoration, integrity check. When restoring to a different server, enter new MySQL connection details. After restoration, check /bitrix/.settings.php — it may need adjustments for the new environment. Limitation: large archives (10+ GB) cannot be restored via browser — the process will time out due to PHP time limit. For such cases, we use the command line.

Restoration via Command Line (CLI)

For serious incidents, we use only CLI. The full recovery algorithm on a new server consists of several stages. First, prepare the environment: install BitrixEnv or configure nginx + php-fpm + MySQL manually with parameters matching the original server. The PHP version must match — even a minor version discrepancy can cause fatal errors. Then deploy files:

cd /home/bitrix/www
tar -xzf /path/to/files_backup.tar.gz --strip-components=N
chown -R bitrix:bitrix /home/bitrix/www

Then restore the database:

mysql -u bitrix -p sitedb < /path/to/db_backup.sql
# or for gzip archive:
gunzip -c /path/to/db_backup.sql.gz | mysql -u bitrix -p sitedb

For large databases (over 1 GB), add acceleration parameters:

mysql -u bitrix -p --init-command="SET SESSION foreign_key_checks=0; SET SESSION unique_checks=0;" sitedb < db_backup.sql

Next, configure database connection: check /bitrix/php_interface/dbconn.php and /bitrix/.settings.php — connection parameters must match the new environment. Be sure to clear cache:

rm -rf /home/bitrix/www/bitrix/cache/*
rm -rf /home/bitrix/www/bitrix/managed_cache/*
rm -rf /home/bitrix/www/bitrix/stack_cache/*

And verify permissions: the /bitrix/ directory must be writable by the web server (cache, temporary files), /upload/ also writable.

How to Determine the Date of a Hack to Choose the Right Archive

If the site is hacked, restoration from backup is not just a rollback. You need to determine the date of the hack (nginx logs, access_log, timestamps of modified files via find /path -newer /path/reference_file). Choose an archive created before that date. Restore and check for backdoors — even a "clean" archive may contain malicious code if the hack occurred before the archive was created. Fix the vulnerability: update Bitrix, close the attacked vector (often an outdated plugin, weak FTP/SSH password, vulnerable PHP script).

One of our clients — an online clothing store — faced massive PHP file infection. Google started showing a warning "This site may be dangerous," the hosting company disabled the site. We scanned the project with the AI-Bolit utility — 847 modified files were found. We determined the infection occurred 5 days ago, so the "yesterday's" copy was also infected. We used a two-week-old file copy and a fresh database (order data). The site was restored in 1.5 days with enhanced security. Data loss: only content from two weeks had to be manually restored, orders were preserved. This case shows that even with a serious hack, restoring a 1C-Bitrix site from a backup is possible with minimal losses.

What to Do If the Backup Is Outdated

Sometimes the last backup is a week old, but only data from the past few days is lost. In such cases, we apply granular restoration: deploy the archive in a test environment, export needed elements (infoblocks, pages, orders) from the test copy, and transfer them to production via API or admin panel. This avoids losing fresh data. For example, in case of a module update error (white screen), we roll back only the module files from the backup without affecting the database. Restoration takes 15–30 minutes.

Typical Restoration Mistakes and How to Avoid Them

One of the most common mistakes is ignoring PHP and MySQL versions. If the new server has a different major version, fatal errors may occur. We check phpinfo() parameters on the original server before the crash. The second mistake is restoring to the same server without clearing the cache. Old cache files may conflict with the updated database — always delete /bitrix/cache/. The third is desynchronization of files and database. If using copies from different dates, ensure the Bitrix version in files and DB matches. And finally, restoration without checking permissions: even after a successful restore, image uploads or cache may not work — set bitrix:bitrix ownership.

Restoration Timeframes: What Depends

We guarantee that with a current backup and server access, we will restore your site within the indicated timeframes. Our team consists of certified 1C-Bitrix specialists with over 10 years of experience, and we take responsibility for the result. Contact us to assess your project — we will analyze your current backup system and propose an optimal strategy. Get a consultation today.

1C-Bitrix Site Security: Audit, Protection, Monitoring

The last serious mass hack of Bitrix sites exploited a vulnerability in the vote module (BDU:2022-05127). Attackers uploaded web shells in bulk. The cause? Site owners hadn’t updated the kernel for six months, and the voting module was left installed “just in case.” Little has changed since then in terms of approach: Bitrix releases a patch, but it takes three months to apply. We build comprehensive site security so that the time between patch release and application is days, not months. And even without a patch, the site won’t fall to a typical attack. Our team: 10+ years of Bitrix security experience, certified specialists, over 500 projects secured.

Order a site security audit — get a prioritized report and a vulnerability remediation plan in 1–2 days. Guaranteed 95% attack reduction for properly configured WAF.

Why Is Proactive Protection Better Than Reactive Cleanup?

The security module is installed on almost every Bitrix site, but it’s properly configured on at best one in five. Here’s what exactly needs to be enabled and adjusted:

• WAF (Web Antivirus) — filters SQL injections, XSS, CSRF, path traversal at the OnPageStart level. Key setting: “Active Reaction” mode — not just log, but block. In /bitrix/admin/security_filter.php, check that all attack types are enabled and exceptions are minimal. A well‑tuned WAF blocks 95% of automated attacks; relying solely on kernel updates leaves you exposed for months.
• Activity control (/bitrix/admin/security_iprule.php) — limits on requests from a single IP. Default is 100 requests per minute. For API endpoints used by mobile apps, exceptions are needed — otherwise you’ll block your own users.
• 2FA — OTP via Google Authenticator. Enable in user settings. Make it mandatory for the “Administrators” group via OnAfterUserAuthorize — no second factor, no admin access. Mandatory for all admin users.
• File integrity check (/bitrix/admin/security_file_verifier.php) — hashes of system files. If someone modifies a file in /bitrix/modules/, the system will notice. Run daily via cron using agent CSecurityFileVerifier::Verify().
• Stop list — b_security_filter_stoplist. Automatic IP blocking when WAF triggers. Manual addition of subnets when scanners are detected.
• Security log — b_event_log. Who changed what and when in the admin panel. Store for at least 90 days. Invaluable during incident investigation.

What Does a Bitrix Site Security Audit Include?

Server level — this is where most holes are:

• phpinfo() accessible via /info.php or /phpinfo.php — found on every third project. The attacker gets PHP version, paths, modules, configuration. Delete it.
• display_errors = On on production — stack traces with file paths and table names are sent to the user’s browser.
• PHP functions exec, system, passthru, proc_open not disabled in php.ini. If a web shell gets uploaded, these functions give full server control.
• PHP version should be 8.1+ — no security updates for earlier versions; PHP 7.4 is no longer supported but still lives on a quarter of projects.

Application level:

• Outdated modules: vote, forum, blog — often unused but with active handlers. Deactivate and remove.
• Custom code: grep for $DB->Query( with concatenation of $_REQUEST — classic SQL injection. Should use $DB->ForSql() or D7 ORM.
• File upload: if CFile::CheckFile() is not called or only checks extension without MIME type, a .php file will be uploaded via the feedback form.
• dbconn.php and .env — must be blocked by web server rules. Check: curl https://site.ru/bitrix/.settings.php should return 403.

SSL/TLS:

• Rating A or higher via SSL Labs.
• HSTS with max-age of at least 31536000 (one year).
• HTTP -> HTTPS redirect at Nginx level, not at Bitrix level.

Audit result — a prioritized report: Critical / High / Medium / Low. Critical issues are fixed on day one. Contact us — we’ll assess your project in 1–2 days and provide a detailed remediation roadmap.

Healing Hacked Sites — Protocol of Actions

The site is already compromised — SEO spam, redirects to casinos, web shell in /upload/. Order of actions:

1. Isolation — take the site down, put up a placeholder. If malware is encrypting files or spreading, every minute counts.
2. Identify the vector — access logs (access.log), error logs, b_event_log. Look for POST requests to unusual files, requests to /upload/*.php, suspicious user agents.
3. Search for malicious code — grep -r "eval(base64_decode" /home/bitrix/www/ — classic. Also look for assert(, preg_replace with e modifier, ${_GET}, obfuscated variables like $GLOBALS['x46x65'].
4. Check the database — b_iblock_element_property and b_iblock_element for injected scripts and hidden links. SELECT * FROM b_iblock_element WHERE DETAIL_TEXT LIKE '%<script%' AND DETAIL_TEXT NOT LIKE '%bitrix%'.
5. Clean or restore — if infection is massive, it’s easier to restore from a clean backup and apply only content changes from the DB.
6. Close the vulnerability — update the kernel, remove unused modules, fix custom code.
7. Request re-scan — Google Search Console → “Request Review”, Yandex.Webmaster → “I fixed everything”.

Investing in a preventive audit can save up to 80% of the cost of emergency incident response. Guaranteed recovery within 1–3 days for subscription clients.

How to Protect a Bitrix Site from DDoS?

• Cloudflare / DDoS-Guard / Qrator — traffic proxying. L3/L4 attacks are filtered on their side. L7 — through rules and challenge pages. Important: after connection, hide the real server IP, otherwise the purpose is lost.
• Rate limiting on Nginx: limit_req_zone for /bitrix/admin/, /api/, forms. Separate limits for authenticated and anonymous users.
• CAPTCHA — \Bitrix\Main\Captcha\CaptchaManager for Bitrix forms or reCAPTCHA v3 for custom ones. v3 doesn’t annoy users — works in the background.
• Bot management — allow Googlebot, YandexBot (check via reverse DNS), block scanners and scrapers by User-Agent and behavior.

Comparison: rate limiting on Nginx is 5 times more effective than standard brute force protection in Bitrix, as it cuts off the attack before it reaches PHP.

Why Is File Integrity Monitoring Critical?

File integrity check (/bitrix/admin/security_file_verifier.php) — hashes of system files. If someone modifies a file in /bitrix/modules/, the system will notice. Run daily via cron using agent CSecurityFileVerifier::Verify(). Combine with inotify on /upload/ — any new .php file triggers an immediate alert.

Backups — The Last Line of Defense

• Daily backups: files via rsync + PostgreSQL/MySQL dump via pg_dump/mysqldump.
• Store in isolated S3-compatible storage. Key word: isolated. If backups are on the same server as the site, the attacker will delete them too.
• Rotation: daily × 7, weekly × 4, monthly × 12.
• Test restoration — quarterly, restore a backup on a test server. A backup that cannot be restored is just a file on disk.
• Monitoring: if a backup fails — alert in Telegram within an hour.

Monitoring — Detect Before the Client Calls

• Uptime — check every 60 seconds via UptimeRobot / Zabbix / custom script. Alert in Telegram + phone call if downtime > 5 minutes.
• File monitoring — inotify (Linux) or cron + md5sum on critical directories. New .php in /upload/? Alert immediately.
• Malware scanning — AI-BOLIT or ClamAV on schedule. Check both files and database.
• SSL certificate — warning 30/14/7 days before expiry. Let’s Encrypt auto-renews via certbot, but certbot can also fail.
• Blacklists — check domain and IP in Google Safe Browsing, PhishTank, Spamhaus. Being listed means traffic loss.

152-FZ and Personal Data (Russian Law Context)

• HTTPS everywhere — redirect at Nginx level.
• Encryption in the database: passwords via \Bitrix\Main\Security\Password::hash() (bcrypt), tokens via openssl_encrypt.
• Privacy policy + cookie banner (the main module supports out of the box via COption::SetOptionString("main", "cookie_agreement", "Y")).
• Logging access to personal data — who and when viewed client data.

Deliverables

Timelines

We work on a one-time basis and on subscription with a fixed SLA. For subscription clients, a dedicated engineer who knows the project. Get a consultation — we’ll assess risks and prepare a quote in 1–2 days.

Checklist: 15 Items We Check on Every Project

1. 1C-Bitrix kernel and modules — up to date, unused modules removed.
2. security module active, WAF in “Active Reaction” mode.
3. 2FA enabled for all accounts with admin access.
4. /bitrix/admin/ protected by IP or additional HTTP authentication.
5. Password policy: at least 12 characters, mixed case, numbers, special characters.
6. SSL/TLS: A+ rating on SSL Labs, HSTS enabled.
7. Service files (dbconn.php, .settings.php, .env, backups, logs) — 403 from browser.
8. Permissions: 644 files, 755 directories. Web server is not owner of system files.
9. Security headers: Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Strict-Transport-Security, Referrer-Policy.
10. File integrity check — daily via agent.
11. Backups: daily, isolated storage, restore testing.
12. b_event_log — storage for at least 90 days, regular review.
13. PHP 8.1+, display_errors = Off, dangerous functions disabled.
14. Uptime monitoring + alerts on file changes in /upload/.
15. Reverse proxy or CDN with DDoS protection for high-load projects.

Vulnerability assessment is conducted in accordance with the OWASP Top 10 methodology. Comprehensive Bitrix site security is not a one-time action but a continuous process. Order a full security audit today to avoid spending budget on emergency recovery tomorrow. Contact us for a free consultation — we’ll answer any questions.