Website Backups: The 3-2-1 Rule Explained

In this guide: Website backups made simple: the 3-2-1 backup rule explained, what to back up, how to automate backups, and how to restore your site without panic.

Websites break. Plugins conflict, updates fail, servers crash, hackers strike, and sometimes we simply delete the wrong thing. When that happens, a good backup turns a disaster into a ten-minute inconvenience. No backup can mean losing years of work.

The most reliable way to think about backups is the 3-2-1 rule. Here’s what it means and how to apply it to your website.

Why backups save businesses

Common situations where a backup saves the day:

• A bad update breaks your theme or checkout page.
• Malware or hacking infects your files or database.
• Human error: a deleted page, overwritten settings, or a bad code edit.
• Hosting problems: hardware failure, account suspension, or a provider shutting down.
• Ransomware or compromised accounts.

Your host may keep backups, but relying on a single copy stored in the same place as your site is risky. If your hosting account is compromised or closed, those backups may disappear too.

The 3-2-1 rule in plain words

• 3 copies of your data: the live site plus at least two backups.
• 2 different storage types: for example, your host’s backup system and a cloud storage service.
• 1 copy off-site: stored somewhere completely separate from your hosting provider.

For a typical website, that could look like:

1. Copy 1: your live website on the server.
2. Copy 2: your host’s automatic daily backups.
3. Copy 3: a backup plugin sending copies to Google Drive, Dropbox, Amazon S3, or similar.

Many professionals extend this to 3-2-1-1-0: one copy offline or immutable (can’t be modified or deleted by attackers) and zero errors after testing a restore.

What to back up (files + database)

A complete website backup includes two parts:

Files

• Your CMS core files (for WordPress: wp-admin, wp-includes).
• Themes and plugins.
• Uploads (images, PDFs, videos).
• Configuration files like wp-config.php and .htaccess.

Database

• Posts, pages, comments, users, settings, orders, and form entries.

The database changes more often than files, especially for stores and membership sites. An online store may need backups several times a day or real-time backups; a blog that publishes weekly can back up daily.

Also back up things outside your site: DNS records (take a screenshot or export), email (if hosted with your web host), and important account credentials stored in your password manager.

Automating backups

Manual backups get forgotten. Automate them:

1. Check your host’s backup policy: How often? How long are they kept? Is restoring free? Can you download them?
2. Install a backup plugin (for WordPress) and schedule:
   – Database: daily (or more often for stores).
   – Files: daily or weekly.
3. Choose off-site storage and connect it to the plugin.
4. Set retention: keep at least 7–30 days of backups so you can go back before a problem started (malware often hides for days).
5. Enable notifications so you know when a backup fails.
6. Back up before every major change — updates, redesigns, migrations.

Compare tools in Best Backup Plugins for WordPress and learn host-level setup in how to set up automatic backups on your hosting.

How to restore without panic

A backup you’ve never tested is a hope, not a plan. Here’s how to stay calm when something goes wrong:

1. Don’t make things worse. Stop editing. If hacked, change passwords first.
2. Identify when the problem started so you choose a clean backup from before it.
3. Restore to a staging site first if possible, to confirm the backup works.
4. Restore files and database using your host’s tool or your plugin’s restore feature.
5. Clear caches (plugin, server, CDN) and test key pages, forms, and checkout.
6. Find the cause — update, plugin, vulnerability — so it doesn’t happen again.

Schedule a test restore every month or quarter. It takes 20 minutes and gives you confidence that your backups actually work.

FAQ

Are my host’s backups enough?
They’re a great first layer, but they live with your host. An independent off-site copy protects you if the account itself has a problem.

How long should I keep backups?
At least 7 days for most sites; 30 days is safer, since infections or errors may go unnoticed.

Further reading: OWASP Top 10 web security risks

Key Takeaways: Website Backups

• Follow 3-2-1: three copies, two storage types, one off-site.
• Back up both files and the database.
• Automate backups and set retention of at least 7–30 days.
• Test restores regularly — a backup is only as good as your ability to restore it.