Website Backups: The 3-2-1 Rule in Practice

Many businesses learn what a backup is worth the first time something breaks. A plugin update turns the site into a blank white screen, a staff member deletes a page by accident, or the site gets hacked. The question in that moment is always the same: “When did we last take a backup?”

Why your host's backup isn't enough

Many hosting companies take automatic backups, and that's good. But it shouldn't be your only safety net, for a few reasons.

The backup sits with the same company as your site, sometimes on the same infrastructure. If the company has a problem, your account is suspended or a payment fails, the site and the backup can become unreachable together. Some plans keep backups for only a few days. If malicious code got into the site and was noticed two weeks later, every backup you have may already be infected. Some hosts also charge separately for a restore.

Finding this out from your contract or support team takes ten minutes. Don't say “we have backups” until you have.

The 3-2-1 rule

The rule is simple: keep 3 copies of your data, on 2 different types of storage, with at least 1 somewhere else. Applied to a small business site, it looks like this:

• The live site (first copy)
• The host's automatic backup (second copy)
• An automatic backup sent to another company's cloud storage, such as Google Drive, Dropbox or an object storage service (third copy, off-site)

It also helps to know that a backup has two parts: files (theme, images, uploaded documents) and the database (posts, products, orders, members). Backing up only the files is like keeping a book's cover and throwing away the pages. In database-driven systems, most of the content lives in the database. If backups contain customer data, remember those copies need to be protected at least as well as the live site.

How often should you back up?

Ask the question the other way round: how many days of data can you afford to lose?

For a company site whose content changes once a month, weekly backups are usually enough. A site where posts or products are added daily needs daily backups. For an online store taking dozens of orders a day, backing up the database more often, even hourly, makes sense; file backups can stay daily.

Retention matters too. Keeping the last 7 daily backups plus one from each of the last 4 weeks is a good balance against problems that are noticed late. And take a manual backup right before any major update.

Testing a restore

An untested backup isn't a backup, it's a hope. A common situation: automatic backups have been running for years, but the files turn out corrupt or incomplete, and nobody finds out until they're needed.

Once a quarter, restore a backup to a test environment (a subdomain or a local computer). Does the site open, are the images there, is the latest content included, does the contact form work? Note how long the restore takes. In a real crisis, knowing that number decides what you tell your customers.

Backup checklist

• How many days does the host keep backups, and is restoring charged?
• Are files and the database backed up together?
• Is at least one copy stored with a different company?
• Does backup frequency match how fast the site changes?
• When was the last restore test?
• Do the accounts holding the backups have separate passwords and two-factor authentication?
• Do you get notified if a backup fails?

The last item is often skipped. A backup plugin can fail for months without anyone noticing.

Whose job is this?

Because backups are “everyone's job”, they often end up being nobody's. The agency assumes the host takes them, the owner assumes the agency does, and the host does exactly what its contract says and no more. All three parties looking at each other in the middle of a crisis is a common scene.

The fix is simple: name one person or company responsible for backups and put it in the maintenance contract, or at least in an email. Note where the backups live and how a restore works in the same place. If the responsible person changes, that note stays with you.

We explained how to use backups if your site gets hacked in a separate post, and gathered the rest of routine maintenance into a monthly checklist. Kodyva's monthly maintenance package includes regular backups; the scope is stated in the quote. Ask us if you'd rather not keep track of this yourself.