How to Back Up a Website — The 3-2-1 Rule
The 3-2-1 backup rule means keeping 3 copies of your data on 2 different media types with 1 copy offsite. Most hosts offer automated daily backups, but you should verify restores quarterly.
The 3-2-1 backup rule means keeping 3 copies of your data on 2 different media types with 1 copy offsite. Most hosts offer automated daily backups, but you should verify restores quarterly. A website without a tested backup is one server failure away from disaster.
Why backups matter
A website can disappear in seconds. A server crash, a ransomware attack, a mistaken file deletion, or a corrupted database update can wipe out months of work. Without a backup, recovery is either impossible or expensive enough that many small businesses never recover.
The statistics are sobering: 60 percent of small businesses that lose their data close within six months. Websites that rely on a single hosting provider without independent backups are gambling their entire digital presence. A proper backup strategy costs almost nothing compared to the cost of rebuilding from scratch.
Backups also serve operational purposes. They allow you to roll back a bad plugin update, restore a single file that was accidentally edited, or spin up a staging environment from a production snapshot. Knowing how to back up a website is a fundamental skill for anyone who owns or manages a site.
The 3-2-1 backup rule explained
The 3-2-1 backup rule is the industry standard for data protection. It is simple to understand and essential to follow:
| Number | Rule element | What it means |
|---|---|---|
| 3 | Copies of your data | Your live site counts as one copy. You need two additional copies. |
| 2 | Different media types | For example, one copy on your server and one in cloud storage. Do not keep both copies on the same server. |
| 1 | Copy offsite | At least one copy in a different physical location or a different cloud provider. |
A practical 3-2-1 implementation looks like this: Copy 1 is your live website on the hosting server managed via your control panel. Copy 2 is a daily backup stored on the same host but on a different storage volume. Copy 3 is an offsite backup sent to cloud storage like Google Drive, Dropbox, or S3-compatible storage every 24 hours. This setup survives a server failure, a hacked account, and even a data centre disaster.
Backup methods — cPanel, plugin and CLI
There are three common ways to back up a website, each suited to different technical levels and site types:
cPanel Backup Wizard. The simplest method for shared hosting users. Log in to cPanel, open the Backup Wizard, select full or partial backup, and download the archive to your computer. This backs up files, databases, email forwarders, and configuration settings in one operation.
WordPress backup plugins. For WordPress sites, plugins like UpdraftPlus, BackupBuddy, and Jetpack VaultPress automate the process. They can send backups to cloud storage on a schedule and include one-click restore. This is the most accessible way to back up a website for non-technical users.
Command line scripts. For VPS or dedicated server users, simple shell scripts using mysqldump, tar, and rsync provide complete control. A cron job runs the script daily and uploads the archive to S3 or another remote location. This method requires technical knowledge but is the most reliable and auditable approach.
How to schedule backups
Backup frequency depends on how often your content changes. Use this guide to determine the right schedule:
- Daily. Minimum for any website that publishes or receives data. Most hosting providers offer daily automated backups as a standard feature.
- Every 6 hours. Recommended for e-commerce sites, membership portals, or any site where losing a few hours of data would cause significant loss.
- Real-time. Necessary for financial applications, booking systems, or sites with continuous data entry. Achievable via database replication and incremental file syncing.
- Weekly. Acceptable only for static brochure sites that change less than once a month. Even then, daily backups are so inexpensive that there is little reason not to enable them.
When you back up a website, also decide on retention. Keep daily backups for 7 days, weekly backups for a month, and monthly backups for a year. This gives you recovery options at multiple time scales without consuming excessive storage.
How to test a restore
A backup that has never been restored is not a backup. It is a wish. Testing restores quarterly is the only way to confirm that your backup process actually works and that the resulting archive is complete and uncorrupted.
To test a restore, set up a staging environment or a subdomain and restore your latest backup there. Verify that every page loads, images display correctly, forms submit, the database contains recent content, and any integrations (payment gateways, APIs, email) function normally. Time how long the restore takes so you know what to expect in a real emergency.
If the restore fails, fix the backup process before the next test. Common failures include incomplete database dumps, missing file permissions, and backups that were interrupted before completion. A quarterly restore test takes 30 minutes and is the single most valuable maintenance task you can perform for your website.
Frequently asked questions
Daily automated backups are the minimum for any active site. E-commerce and membership sites should back up every few hours. At a minimum, ensure you have a backup from within the last 24 hours at all times.
Keep 3 copies of your data on 2 different types of media (e.g. server plus cloud storage), with 1 copy stored offsite in a different physical location or with a different cloud provider.
Yes for convenience, but never exclusively. Host backups are designed for disaster recovery, not individual file restoration. Always maintain your own independent backup as a second copy.
Use a plugin like UpdraftPlus or Jetpack VaultPress, or do it manually via cPanel Backup Wizard and phpMyAdmin for the database. The plugin method is simpler and allows scheduled automatic backups to cloud storage.
Restore your backup to a staging environment once per quarter. Check that all pages load, images display, forms submit, and the database is current. A backup that has never been tested is not a backup.