BLOG
Website backups: the 3-2-1 rule in practice
A backup sitting on the same server as your website won't save you when something serious goes wrong. Here is the 3-2-1 rule and how to apply it simply to a website or e-shop.
People talk about backups only when it’s too late: a hacked website, a failed update, accidentally deleted products or a hosting outage. At that moment only one question matters: do you have something to restore from, and how old is it?
What the 3-2-1 rule says
- 3 copies of the data – the original and two backups.
- 2 different types of storage – for example the server and cloud storage.
- 1 copy off-site – at least one backup must be completely separate from the server the website runs on.
The rule comes from IT infrastructure, but it suits websites perfectly. It protects you against disk failure, attacks and provider errors.
Why the hosting provider’s backup isn’t enough
Many hosting providers include backups in the price. That’s a good start, but it has weaknesses: the backups often sit in the same infrastructure, they are kept only for a short time and restoring may not be immediate. If an attacker gains access to your account, they can delete both the website and the backups at once.
What to back up
- The database – content, orders, customers, settings.
- Files – uploaded images and documents, themes, plugins, configuration.
On an e-shop the database changes all the time, so it is backed up more often than the files. For a regular company website a daily backup is enough; for a busy e-shop, several times a day.
A backup you have never restored is not a backup
The most common failure isn’t a missing backup, but a backup that can’t be used: a corrupted file, a missing database, incomplete data. That’s why restores are tested regularly: the backup is loaded onto a staging environment and the website is checked to make sure it works.
How to set it up simply
For most websites an automatic tool is enough – one that backs up the database and files every day and sends them to external storage, such as the cloud. Add a retention period so you can go back several weeks, and an alert if a backup fails.
Summary
Backups are cheap insurance: three copies, two types of storage, one off the server, and regular restore tests. If you’re not sure what state your backups are in, it’s one of the first things checked when a website is taken into maintenance.