Website Backups: The 3-2-1 Rule and What to Ask Your Host

A backup that lives on the same server as your site is not much help if the server fails or is attacked. The 3-2-1 rule gives a simple way to think about it, and it turns into a short list of questions for any host.

This guide is based on the public sources listed at the end. We have not tested the products or services mentioned.

This is a short reference page. The full guide is Web Hosting and Domains: The Complete Guide.

The 3-2-1 rule

The US Cybersecurity and Infrastructure Security Agency (CISA) gives this guidance for small and medium businesses:

• Keep three copies of important files.
• Store them on two different types of storage.
• Keep one copy off-site.

Cloud storage can serve as the second type. Mixing on-site and remote copies protects against both cyber attacks and physical damage.

What to include

CISA lists customer and financial records, email, configuration files, and website or operational databases. It suggests starting with an inventory: what data you have, where it is kept, and who can reach it.

Good habits

• Run backups automatically on a regular schedule rather than remembering to do them.
• Protect backups with physical security, encryption and offline copies.
• Test restores, full and partial, and make sure you can roll back data by at least seven days.

Turning it into host questions

CISA's page is general business advice, not a hosting checklist. For a website you can ask:

1. Does the host keep backups on a different server or location from the live site?
2. How often are backups taken and how long are they kept?
3. Can I download my own full copy?
4. How do I restore, and does restoring cost extra?
5. Who is responsible for backups on this plan: the host or me? Read the terms, because this is often the customer's duty.

Our guide to what a web host plan includes compares plan types.