Back Up and Migrate n8n: Workflows, Credentials and Restore Checks

Before choosing ServerNet n8n hosting, establish the maintenance scope, backup schedule, restore process and access included in the order. Installing n8n on an hourly VPS gives operating-system control, with application maintenance and external backups handled by the server administrator.

Deploy on a VPS and check HTTPS and webhooks

1. Prepare an appropriately sized VPS, a test hostname and Docker Compose. Pin and test the n8n version before upgrades.
2. Follow the official Compose setup. Persist /home/node/.n8n in a volume, bind port 5678 to localhost, and terminate HTTPS at a reverse proxy with a valid certificate.
3. For one trusted proxy, configure the values below and forward X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto. Match the proxy-hop count to your actual route.
4. Create a POST Webhook workflow returning a fixed {"ok":true}. Check its Test URL while listening, then its Production URL after publishing/activation. Attach no payment, messaging or customer-write action.

N8N_HOST=n8n.example.com
N8N_PROTOCOL=https
N8N_PORT=5678
N8N_WEBHOOK_URL=https://n8n.example.com/
N8N_PROXY_HOPS=1

Before n8n 2.30, use WEBHOOK_URL instead of N8N_WEBHOOK_URL. Replace the example hostname. Verify HTTPS, the sample response and backup restoration on your installation.

Define the backup scope

• Workflow definitions and their activation state.
• Encrypted credentials and the matching encryption key, secured separately from public repositories.
• The n8n version, environment configuration, webhook hostname and required extensions.
• The database and required binary data, using a consistent backup method for that database. Workflow JSON alone is not a complete execution-history backup.

Create a reviewable export

For an administrator of a self-hosted installation, the official CLI supports workflow and credential exports. Run these in the installed n8n environment; Docker deployments require the actual container name and destination mount. These are n8n export examples, not ServerNet provisioning commands.

n8n export:workflow --all --output=workflows.json
n8n export:credentials --all --output=credentials.json

Keep credentials private and avoid decrypted exports for routine backups. Restoring encrypted credentials depends on the correct key. Store exports and keys securely outside the source machine. Back up a running database using its supported consistent method rather than copying an arbitrary file while it is being written.

Test with a harmless workflow

1. Prepare a compatible n8n version, required data and encryption key at the destination. Keep it isolated before cutover.
2. Create or import a test workflow with a Manual Trigger and fixed output; connect no real messaging, payment or customer-write action.
3. Check integrations using test accounts and limited permissions. Review destination OAuth redirect URIs where the hostname changes.
4. Activate real webhooks and schedules only after coordinating source shutdown and cutover. Two active copies can perform the same work twice.
5. Keep the source and last backup until the agreed rollback window closes.

Acceptance and common failures

A backup file’s existence is not a restore test. Check workflow counts, credential decryption, a sample execution and the destination webhook route. Decryption errors may indicate a mismatched key; do not replace a key without a secured original. Missing execution history after importing workflows does not necessarily mean the import failed: that history is separate data.

For managed hosting, adapt the steps to the access included in your service. Zero downtime, retention periods and one-click recovery require an explicit order scope and acceptance test. No live customer migration was performed for this guide.

Sample restore verification

On 25 October 2026, a synthetic fixture was tested on n8n 2.30.0 using two isolated SQLite environments: workflow execution, workflow and encrypted-credential export/import, execution after restore, and credential decryption with the original key all passed. An incorrect key was rejected. This does not verify a customer migration, a full database backup, Docker, HTTPS or your webhook route.

References: official n8n CLI and encryption keys.

Docker Compose · HTTPS / webhook