Website Backup Guide: The 3-2-1 Rule Every Site Owner Needs

Half of our restoration clients say the same sentence: “I thought the hosting had backups.” This article exists so you never say it. Twenty minutes of setup buys you immunity from the most expensive category of website disaster.

Why “the host does backups” fails

• Retention is short. Typical host backups keep 7-30 days. Hacks and quiet corruption are often discovered later than that.
• They die with the account. Suspended for non-payment, closed provider, deleted account: the backups vanish with the hosting, precisely when needed most.
• They are rarely tested. An unrestored backup is a hope, not a backup.
• Same-server storage. Some cheap hosts keep “backups” on the same disk as the site. One disk failure, two losses.

The 3-2-1 rule, translated for websites

3 copies of your site (live + two backups), on 2 different types of storage, with 1 copy offsite, away from your hosting provider entirely.

A practical, nearly free implementation:

1. Live site on the host.
2. Automated host/panel backups (fine as the fast-restore copy).
3. Automated offsite backups to cloud storage you own: Google Drive, Dropbox, S3, Backblaze B2, pushed by a plugin or script on schedule.

What must be in the backup

• Database, all content, settings, users, orders. Changes daily on active sites; back up daily.
• wp-content (or equivalent): themes, plugins, uploads. Weekly full + daily incremental is the comfortable pattern.
• Configuration: wp-config.php, server configs, SSL certificates, cron definitions, forgotten in most backups, missed at 2 a.m. during restores.
• The stuff outside the site: domain registrar access, DNS records (screenshot them once), email routing. Losing DNS knowledge turns a 1-hour restore into a 3-day archaeology dig.

WordPress tooling that does 3-2-1 well

• UpdraftPlus, the default recommendation: free tier does scheduled full backups straight to consumer cloud storage.
• WPvivid / All-in-One WP Migration, solid alternatives with clean restore flows.
• Host-level snapshots + rclone script, the sysadmin flavor: cheap, robust, no plugin overhead.
• Managed-host offsite add-ons, fine, as long as one copy still lives in storage you control.

The restore drill: the step everyone skips

Once a quarter, restore your latest backup to a local environment or a $5 temporary VPS. You are verifying three things: the archive opens, the database imports, the site actually boots. The first drill almost always finds a problem, wrong exclusions, truncated database, missing configs, and finding it on a calm Tuesday costs nothing.

Backups are not the goal. Successful restores are the goal. Backups are just the ingredient.

If you are reading this too late

No backups and the site is already gone? Public archives probably remember it: start with our Wayback Machine recovery guide, or let us run the feasibility check free. Then come back to this article and make sure there is no next time.