The 3-2-1 backup rule: How to back up your website and email properly

A folder accidentally deleted, an update that brings the shop to a standstill, a hacked contact form or ransomware on the office PC: whether such an incident is merely a nuisance or poses a threat to the business almost always hinges on one question. Is there a recent backup that can actually be restored? The 3-2-1 rule has been the tried-and-tested benchmark for this for years. We’ll explain what it means and how you can apply it to your website and mailboxes.

The rule in a nutshell

Keep at least three copies of your data, on two different types of storage, and ensure that one of them is retained in a different location.

• 3 copies: the original and two backups. If one fails or is damaged, you still have one left.
• 2 storage types: for example, a server and an external storage device, or cloud storage from a different provider. This ensures that a fault in one system does not affect all copies at the same time.
• 1 copy off-site: physically separate, so that fire, water damage or the failure of a data centre does not affect everything at once.

The extension: 3-2-1-1-0

Because ransomware today specifically targets accessible backups for encryption, many people add two further points to the rule: one copy that is offline or immutable, so that it cannot be deleted or overwritten retrospectively, and zero errors - that is, regularly checked backups with tested recovery procedures.

What needs to be backed up for a website

• Files: programme code, themes, plugins and, above all, uploaded content such as images and documents.
• Database: pages, posts, orders, customer accounts and settings.
• Configuration: Files such as .htaccess, wp-config.php or .env, scheduled cron jobs and your DNS records.
• Email mailboxes: more on this in a moment.

Important: Files and the database should be backed up at the same time. Otherwise, after restoration, posts will link to images that do not yet exist or no longer exist in the current file structure.

Here’s how the rule works with your hosting

1. Copy 1 - the live data on the web server.
2. Copy 2 - your hosting provider’s automatic backup. With shared hosting, we back up web data, databases and emails every night. The backups are stored in encrypted form with geographical redundancy on separate storage in an external data centre. We carry out the restoration free of charge; simply submit a support ticket. You can find details in our article ‘How does our backup system work?’.
3. Copy 3 - a backup in your own hands. For example, a backup created and downloaded regularly to your own storage, such as a NAS or another provider’s encrypted cloud storage.

Why have a third copy if the hosting provider already backs up your data? Because it gives you independence: from the retention period of the hosting provider’s backup, from switching providers, and from the risk of your login details falling into the wrong hands. It’s also worth carrying out a manual backup before making major changes, such as updates or a theme change.

Don’t forget your mailboxes

A common misconception: “My emails are in my email programme, aren’t they?” With IMAP, the messages are stored on the server; the programme merely displays a synchronised version. If you accidentally delete a folder there, it will also disappear from the server and from all other devices. IMAP is therefore not a backup.

• Server backup: Our nightly backup includes mailboxes; individual accounts can be fully restored.
• Your own copy: Email programmes such as Thunderbird or Outlook can archive or export folders locally. This file should then be included in your own data backup.
• Archiving: Business emails may be subject to statutory retention requirements. A backup is no substitute for audit-proof archiving. It is best to clarify the requirements with your tax adviser.

A backup is only as good as its restoration

Many people only realise in an emergency that the backup is incomplete or that nobody knows how to restore it. You should therefore plan ahead:

• How old can the latest backup be at most? For a shop with lots of orders, 24 hours might be too long; for a business card website, that’s easily enough.
• How long can a system outage last? This determines how quickly the system must be restored.
• Test the recovery process at least once a year, for example on a test subdomain.
• Encrypt your own backups and store the key separately from them.

Your checklist

• Three copies, two storage methods, one off-site.
• Files, database, configuration and mailboxes covered.
• One copy offline or read-only.
• Recovery tested and documented.
• Manually backed up before updates.

Do you run a cloud server? If so, find out how our external backup for cloud servers works.