The 3-2-1 Backup Rule for Websites (and Why Your Host's Backup Isn't Enough)

Ask a store owner whether they have backups and the answer is usually yes — the host handles it. Ask when they last restored one and the room goes quiet. The 3-2-1 rule exists because a single backup, in a single place, controlled by a single account, fails at precisely the moment you need it.

The rule, unpacked

Keep three copies of your data: the live site plus two backups. Store them on two different kinds of storage, so one failure mode can't take both. Keep one copy offsite — meaning outside your hosting account entirely, not just on a different server in the same login.

Why the host's backup flunks the test

Your host's backup usually lives on the same infrastructure, under the same account, behind the same password as the site itself. If the account is compromised, the attacker can delete the backups along with the site. If the host has an outage, a billing dispute, or goes out of business, both copies vanish together. Add short retention windows — often 7 to 30 days, less than the time malware typically sits undetected — and the convenient backup turns out to be one copy, one medium, zero offsite.

What a complete website backup contains

A screenshot of your homepage is not a backup. A restorable one includes:

• Files — theme, plugins, and everything customers uploaded
• The database — orders, customers, products, and content
• Configuration — wp-config or equivalent, plus server rules
• A record of DNS and email settings, kept anywhere you can read it during an outage

Automating the offsite copy

Use a backup plugin or host tool that pushes a nightly copy to storage you control under a separate account — an S3 bucket, Google Drive, or similar — with its own strong password and two-factor authentication. A workable retention schedule: 30 daily copies plus a monthly copy kept for a year, which covers both quick mistakes and slow-burn infections.

An untested backup is a rumor

Once a quarter, restore to a staging environment and actually click around: do recent orders appear, do images load, can you log in? Time the restore, too — that number is your real recovery time, and it's better to learn it on a calm Tuesday than during an incident.

Backups get you back up after something goes wrong; Trust Guard's daily scans and monitoring shorten the window before you know something went wrong. Together they turn a potential disaster into a restore and a patched hole.