The 3-2-1 backup rule is the simplest reliable backup strategy: keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite. For a website it means you never rely only on your host's backups, and that a single failure, mistake or attack cannot take every copy with it.
Before you start
- Know what makes up your site: files in
public_html, databases, email and DNS records. - Decide how much data you can afford to lose (RPO) and how fast you must be back online (RTO).
The 3-2-1 backup rule explained
| Part | Meaning | Website example |
|---|---|---|
| 3 copies | The live data plus two backups | Live site, host backups, your own offsite copy |
| 2 media | Different storage systems so one fault cannot hit both | Host backup server and cloud object storage |
| 1 offsite | A copy in a different location and provider | S3-compatible storage or a home NAS |
Many teams now use 3-2-1-1-0: one copy immutable or offline, and zero errors in restore tests.
Applying 3-2-1 to web hosting
- Copy 1, live data: your site on the hosting server.
- Copy 2, host backups: MdmHost runs daily JetBackup backups that you can restore yourself from cPanel. These are on separate backup storage, not the same disk as your site.
- Copy 3, your own offsite backup: download a full cPanel backup on a schedule, or push it automatically to remote storage over SFTP, rsync or S3.
Warning: Host backups protect against server failure and mistakes, but not against losing access to the account, a billing dispute or the provider itself. Your own offsite copy covers those cases.
Choosing backup frequency and retention
- Brochure sites: weekly offsite copies plus daily host backups are usually enough.
- Shops and membership sites: daily database backups at least, more often for busy stores.
- Retention: keep several daily, weekly and monthly points. Malware or a silent data error is often noticed weeks later, so one recent backup is not enough.
Protecting backups from ransomware and attackers
- Use separate credentials for backup storage and do not store them on the website.
- Prefer storage with versioning or object lock so backups cannot be deleted or overwritten for a set time.
- Encrypt offsite backups that contain customer data.
Testing restores
A backup you have never restored is a guess. At least every quarter:
- Restore a backup to a staging subdomain or local environment.
- Check that pages load, logins work and recent orders or posts are present.
- Time the restore and note the steps so anyone on your team can repeat them.
Backup strategy for resellers
If you host clients, your offsite copy should cover every account. Document what clients can restore themselves and what goes through your support, and say clearly in your terms what you back up and how long you keep it.
Troubleshooting
- Full backup too large to download: back up databases and changed files separately, or use incremental rsync.
- Restored site shows old content: the database and files came from different points in time. Restore both from the same backup.
Frequently asked questions
Are my host's daily backups enough?
They count as one copy. For the 3-2-1 rule you also need one copy you control at another provider or location.
Is cloud sync the same as a backup?
No. Sync copies deletions and corruption too. A backup keeps older versions you can return to.
Should email be backed up?
Yes if mail lives on your hosting. A cPanel full backup includes mailboxes, and JetBackup can restore email separately.