An employee deletes a folder from the website by mistake, a plugin update breaks the store, or the server gets hacked. You ask your host for the backup and find the latest one is three weeks old, or that it was stored on the same server that failed. This keeps happening because nobody asked about backups until the day they needed one.
What is the 3-2-1 backup rule?
The 3-2-1 rule means keeping three copies of your data, on two different types of storage, with at least one copy away from the original location. It is an old rule from the IT world, and it is still the simplest way to tell whether your backups will survive a real problem.
For a company website on hosting, it might look like this: the live data on the server, a daily copy the host takes to separate storage, and a third copy sent automatically to cloud storage in an account the company owns with another provider.
- 3 copiesThe original data plus two backups
- 2 storage typesFor example, hosting storage and independent cloud storage
- 1 offsite copyWith another provider, in an account the company owns
- Restore testRegularly, in a separate environment
Some teams add a copy that can't be changed or deleted for a set period (immutable) to the rule, because ransomware also tries to reach and encrypt backups connected to the network.
What should a website backup include?
The files and the database together, taken at roughly the same moment. A file backup without the database gives you back the theme, minus the articles, orders and users.
- Website files, including uploaded images and configuration files.
- The full database.
- Mailboxes, if they live on the same server.
- DNS records and domain settings, in a plain text file.
- Login details for the hosting account and registrar, in a company password manager.
How often should you back up, and how long should you keep backups?
Work it out from two questions: how many days of data can the company afford to lose, and how many hours can the site afford to be down? A store taking orders every day needs at least a daily backup. A brochure site that rarely changes is fine with a backup after each edit plus a weekly one.
How long you keep backups matters just as much. A hack can sit unnoticed for weeks, and if your host keeps only the last seven days, every copy you have may be infected. Keep daily backups for days, weekly ones for weeks and monthly ones for several months. We explain why you need a copy older than the hack in your website was hacked: what to do in the first 24 hours.
How do you back up company email?
It depends on where the email lives. If it is on cPanel hosting, it is stored as files on the server and included in a full account backup, and you can also copy it to another server with tools that move IMAP mailboxes. Just confirm that your host's backups include email, because some plans leave it out.
If your email is on Microsoft 365 or Google Workspace, the provider protects its infrastructure against failures and keeps deleted items for a limited time. A message an employee deliberately deletes before leaving, or an account that gets closed, may be unrecoverable once that period ends. That is why many companies use a third-party backup tool for cloud email accounts.
File sync does not count as a backup. If a file is deleted or encrypted on one device, the problem reaches every synced device within seconds.
How do you test that a backup actually works?
Restore it. A backup that has never been restored may be incomplete or corrupted without anyone knowing.
- Pick a fixed schedule, say once a quarter, and also after any major change to the site.
- Restore the latest backup to a separate environment or a temporary subdomain, away from the live site.
- Open the site and try logging in, the key pages and the contact form.
- Check the date of the most recent order or article in the database.
- Write down how long the restore took, who did it and what was missing.
The first test usually turns something up: a database that wasn't included, an offsite storage password nobody knows, or a backup too large to download quickly. Finding that out on a quiet day is far better than finding it out during an outage.
What should you ask your hosting provider about backups?
Ask how often backups are taken, how many days they are kept and where, whether they include email and databases, and whether you can restore by yourself or need to open a ticket. These questions are part of the list in how to choose hosting for your company website.
We set up daily backups with an off-server copy and test restores for our clients as part of our hosting, server and email service. If you aren't sure where your website's backups are today, send us your domain name and hosting provider and we will help you find out.
Questions our partners ask
What is the 3-2-1 backup rule?
Three copies of your data, on two different types of storage, with at least one copy somewhere else, away from the original server.
Are my hosting provider's backups enough?
They are a useful first line, but they usually sit on the provider's own infrastructure and may only be kept for a few days. Keep an extra copy in an account you own with a different provider.
Do Microsoft 365 or Google Workspace keep a backup of my email?
They keep deleted messages for a limited time and offer retention tools, which is different from an independent backup you can restore a full account from as of a specific date. If your email matters, consider a third-party backup tool.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
