Take a mirror clone of the repository (git clone with the mirror option) to get a bare copy holding every branch, tag and other ref. Refresh it on a schedule with git remote update, store it apart from the host, and test by cloning from it.
What a mirror clone is
Git's own manual explains the difference. A bare clone maps the source's branches to local branches. A mirror clone goes further: it maps all refs, including remote tracking branches and notes, and sets up a refspec so that a git remote update in the copy overwrites all of those refs. A mirror also implies a bare repository, so there is no working tree.
That makes it a faithful copy of the repository's history and references, which is what a backup needs.
Steps
git clone --mirror https://example.com/org/repo.git repo.git
cd repo.git
git remote update
- Clone once with the mirror option into a directory outside any developer machine.
- Schedule the update command to run daily or more often, depending on your RPO.
- Copy the directory to storage that the git host's credentials cannot reach.
- Keep several dated copies, not one that is overwritten each time. A force push or a deleted branch will propagate to a single mirror at the next update.
- Test by cloning from the mirror into a clean directory and building from it.
What a mirror does not back up
A mirror holds the Git data only. Other things people treat as part of the repository live in the hosting service:
- Issues, pull request discussion and review comments
- Wiki pages, in many hosts a separate repository
- CI configuration stored outside the repo, and its run history
- Secrets and variables used by pipelines
- Branch protection rules, access lists and webhooks
- Release assets uploaded as files
List which of these you could not rebuild from memory, then decide how to export each one. Many hosts offer an export API for issues and settings.
Mirror, bare or plain clone
| Copy type | Keeps all refs | Good as backup |
|---|---|---|
| Plain clone | Branches you fetched | Weak, depends on what was fetched |
| Bare clone | Branches mapped locally | Partial |
| Mirror clone | All refs, refreshed by update | Best of the three |
Try it yourself
Click through it at your own pace, or open it full screen.
Notice that a repository's manifests list the dependencies it needs. A mirror of the repo keeps that list, but not the packages themselves, so a backup plan should cover those too.
CISA's ransomware guide lists source code and infrastructure as code templates among things to keep in offline backups. Safeguard can scan repositories for dependency and secret issues, with a free scan available.
Quick check
Does a mirror clone include pull requests?
Not by default. Pull requests are a feature of the host. Some hosts expose them as extra refs, but discussion and review comments need an export.
How often should I update the mirror?
At least as often as your RPO. If losing a day of commits is unacceptable, update more than once a day.
Sources
Last reviewed: 19 October 2026.
