Website Backups: the 3-2-1 Rule Explained

There are two kinds of website owners: those who keep backups, and those who will start keeping them right after their first data loss. Sites do not vanish only because of hackers — far more often it is a failed update, a wrong click, or a plugin that picked a fight with the theme.

The 3-2-1 rule

An industry standard that applies just as well to a small site: 3 copies of your data, on 2 different media, with 1 stored off-site. Translated to a website: the original on the server, an automatic daily backup at your hosting provider, and an occasional copy you download to your own computer or cloud storage. It sounds excessive — until the morning your hosting account is unreachable.

What a backup must contain

A complete website backup has two parts: files (theme, plugins, images, documents) and the database (posts, pages, comments, users, settings, orders). A files-only copy is useless for WordPress — you would restore an empty site. Verify your system captures both.

How often?

• Brochure site that rarely changes: weekly is fine.
• Blog or regularly updated site: daily.
• Online store: daily minimum, ideally more frequently for the database — every hour represents orders.
• Before any major change (WordPress update, theme switch, new plugin): a manual backup, always.

An untested backup is not a backup

The worst case is not having no copy — it is having one and discovering it is corrupt exactly when you need it. Once a quarter, run a test: restore the backup to a staging copy and check that everything works. With us, daily backups come with every plan, restoration takes minutes, and you can try it on staging first.

Where not to keep your only copy

On the same server as the site. If a serious failure, compromise or account problem occurs, the site and its backup disappear together. Always keep at least one copy off the hosting — a monthly download to your own drive or cloud storage is enough.

Five minutes worth spending

Open your hosting panel and check three things: whether backups are enabled, how many days back they reach, and whether they include the database. If your answer to any of those is "I am not sure", now is the moment to find out — not after something breaks.