The 3-2-1 backup rule says to keep three copies of your data, on two different types of storage, with one copy off-site. For a website, that means the live site plus two backups, stored somewhere other than your web server, with at least one in a different location. If your only backup sits on the same server as your site, you don’t pass.
Key takeaways
- Three copies: your live website and two backups of it.
- Two systems: the backups shouldn’t all live on your web server or in one hosting account.
- One off-site: at least one copy in a different data centre or with a different provider.
- Newer versions add a copy attackers can’t delete, and tested restores with zero errors.
What is the 3-2-1 backup rule?
It’s a simple test for whether your data would survive a bad day. Backblaze describes it as keeping “three copies of your data on two different media with one copy off-site” (Backblaze). The rule came from IT departments protecting office files, but it fits websites well.
Each number guards against a different failure. Three copies cover one backup being faulty. Two systems cover a single disk or server dying. One off-site copy covers the whole location being lost, hacked or locked.
What does 3-2-1 look like for a website?
3: three copies
Your live website counts as copy one. You then need two backups. A WordPress backup has two parts, the files and the database, and WordPress.org says you need both (WordPress.org). A backup of the files without the database won’t bring back your pages, orders or settings.
2: two different systems
Backblaze notes that cloud storage has changed this part. Today it mostly means two separate devices, not two types of disk. For a website, the question is simple: if your web server failed completely, would a backup still exist somewhere else?
1: one copy off-site
Off-site means a different building, ideally a different provider. If your host’s data centre has an outage, or someone gets into your hosting account, the off-site copy is the one that survives. Our guide to website backup vs snapshot explains why a server snapshot alone doesn’t count.
Why isn’t my host’s backup enough?
Many hosts keep backups on the same server, or in the same account, as your website. That’s one system, not two. When a server fails or an account is suspended, those backups can go with it.
Hacks are the other risk. Sucuri found backdoors on 49% of the compromised sites it cleaned (Sucuri). Hidden code like that can sit quietly for weeks. If your host keeps only a few days of backups, every copy may already be infected by the time you notice. That’s why how long copies are kept matters as much as where they are.
In our experience, owners usually find this out on the worst possible day. If you’re dealing with that right now, our hacked website repair team can help.
What are 3-2-1-1-0 and the other newer versions?
Ransomware and account takeovers pushed the rule further. Backblaze lists two common extensions (Backblaze):
- 3-2-1-1-0 adds one copy kept “offline or air gapped”, and zero errors, meaning backups are monitored and restores are tested.
- 4-3-2 means four copies in three locations, with two of them off-site.
For most small business websites, 3-2-1 plus tested restores is the sensible target. The “zero errors” idea is the one we’d borrow. A backup you’ve never restored is only a hope.
How do I check whether my website backups pass?
- Count the copies. Ask your host or developer how many backups exist and how often they run.
- Find out where they’re stored. Same server, same account, or a separate provider and location?
- Check how long they’re kept. A few days isn’t enough to roll back a hack found weeks later.
- Confirm both parts are included. Files and database, from the same moment.
- Test a restore. Restore to a staging copy and check that pages, forms and logins work.
Want to run your own? Our guide on how to back up a WordPress site walks through it. When the day comes, our steps to restore a website from backup help you avoid losing recent orders or enquiries.
How we handle it
We’d rather you didn’t have to think about any of this. Every Maintain & Protect plan includes website backups you can restore, stored off-site and kept for 30 days. Essentials backs up daily, Advantage four times a day and Elite hourly. Compare the website maintenance plans to see what else each level covers.
Frequently asked questions
Does Google Drive or Dropbox count as an off-site backup?
It can, as long as the backup is complete and you can restore it. A copy in cloud storage is separate from your web server, which is the point. Make sure it holds both the files and the database, that it’s updated regularly, and that the account is protected with a strong password and two-factor login.
How often should I back up my website?
Match it to how often the site changes. WordPress.org suggests weekly for smaller sites and daily for busy ones, and always before an update. A shop taking orders all day needs backups more often than daily, or every restore will lose sales.
How long should I keep website backups?
Long enough to go back to a clean copy if a problem is found late. Hacks can go unnoticed for weeks, so a few days of backups may all be infected. Around 30 days of copies is a sensible minimum for most business websites.
Is a server snapshot the same as a backup?
Not quite. A snapshot is a copy of the whole server, usually stored with the same provider. It’s handy for a quick rollback, but it shares the same account and location as your site. It helps with copy count, but it doesn’t meet the off-site part of 3-2-1 on its own.
Do I still need backups if my site is on a website builder?
It’s worth checking. Builders like Wix and Squarespace manage their own platform, but you usually can’t export a complete copy you could restore elsewhere. Ask what their backups cover and how long they’re kept, and keep your own copies of content and images.
Sources
- The 3-2-1 backup strategy, Backblaze
- WordPress backups, WordPress.org Advanced Administration Handbook
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- The 3-2-1 backup rule and beyond: 3-2-1 vs 3-2-1-1-0 vs 4-3-2, Backblaze