Website Backups: The 3-2-1 Strategy for Protecting Your Data

Imagine opening your website one morning to find a blank white page, a message from an attacker, or an online store where every order has vanished. At that moment, it doesn't matter how much you spent on design or marketing. The only question that counts is: do you have a recent, working backup? Backing up your website is insurance you only appreciate when you need it.

In this guide you'll learn what can go wrong, exactly what you need to back up, the difference between backup types, how to apply the well-known 3-2-1 rule, how often to back up, and how to create a backup from cPanel or WordPress. Finally, you'll see how to test your restores and set up a simple schedule that fits your business.

Why do you need to back up your website?

Data isn't only lost in major disasters. The most common causes are completely ordinary:

• Hacking: An attacker deletes content or injects malicious code, and you need a clean copy from before the breach. (See our website security checklist.)
• Human error: Deleting a page by mistake, editing a configuration file and breaking the site, or a team member running a command against the wrong database.
• A failed update: A plugin or theme update conflicts with something else and breaks the site.
• Server failure: Hardware fails no matter how good it is, and drives have a limited lifespan.
• Ransomware: It encrypts your files and demands a ransom to unlock them, and it can reach backups stored on the same machine or on drives connected to it.

The common thread: in every case, a good backup turns a disaster into an inconvenience you can fix in an hour or two.

What should you back up? The five parts of your website

Your website is more than just files. A complete backup includes:

1. Files: Your code, theme, plugins, the images and attachments you've uploaded, and files such as .htaccess.
2. Databases: In WordPress and online stores, this is where your posts, orders, users, and settings live. Files alone, without the database, won't bring your site back.
3. Email: The messages in the email accounts on your domain, plus forwarders and filters.
4. DNS zone: Your A, MX, TXT, and other records. Rewriting them from memory after losing them is painful, especially verification records, SPF, and DKIM.
5. Settings: Your PHP version, cron jobs, subdomain settings, and any configuration files such as wp-config.php or .env.

Backup types: full, incremental, and differential

Not all backups are equal. These three types are the most common:

For small websites, a regular full backup is usually enough. As your site grows, combining a weekly full backup with daily incremental backups becomes a practical option, and many plugins and tools handle this automatically.

The 3-2-1 rule: the backbone of any backup strategy

The 3-2-1 rule is one of the best-known and simplest backup rules, and the idea behind it is not to put all your eggs in one basket:

• 3 copies of your data: The live original on the server, plus two backups.
• On 2 different types of storage: For example, your hosting server and cloud storage, or cloud storage and an external drive. If one type fails, the other survives.
• 1 copy off-site: That is, outside the server and the data center that hosts your website. A backup stored on the same server is lost with it if the server fails or the account is compromised.

The modern version: 3-2-1-1-0

With the rise of ransomware, an extended version adds two more numbers: 1 immutable or offline copy that an attacker can't delete even if they gain access to your accounts, and 0 errors when you test your restores. Not every small website needs this level, but the second idea, testing restores, matters for everyone.

Tip: Don't rely only on backups stored inside your hosting account. If the account is compromised or deleted, the backups may disappear with it. Always keep at least one copy somewhere that anyone with your hosting password can't reach.

How often should you back up, and how long should you keep backups?

The simple rule: back up as often as you can afford to lose data. Ask yourself: if my site went back to how it was yesterday, what would I lose?

• Online store or booking site: At least daily, and several times a day for the database if you get a lot of orders.
• Blog or news site updated frequently: Daily or every few days.
• Brochure site that rarely changes: Weekly, plus an extra backup before and after any major change.

Retention

Don't keep just one backup that you overwrite each time. Some breaches aren't discovered for weeks, and if all your backups are from after the breach, they won't help. A common pattern is to keep the last 7 daily backups, the last 4 weekly backups, and the last 3 to 6 monthly backups. Adjust the numbers to your available storage and the nature of your site.

How to create a backup: cPanel and WordPress

If your hosting uses cPanel, you'll find two tools in the Files section: Backup and Backup Wizard. The wizard walks you through step by step, while Backup shows all the options on a single page. The names and available options may vary slightly depending on how your host has set things up. If you're new to the control panel, start with our cPanel beginner's guide.

In cPanel: full backup

This creates a compressed file containing your entire account: files, databases, email, and settings. You choose where to save it (usually your account's home directory), you get an email when it's done, and then you download it. A full backup is a good fit for moving an entire account, but restoring one usually goes through technical support, because it requires server-level permissions.

In cPanel: partial backups

• Home directory: All your files, including your website files and stored email.
• MySQL databases: Each database in its own compressed file.
• Email forwarders and filters: Small files, but a real headache if you lose them.

The advantage of partial backups is that you can restore them yourself from the same page, which makes them the best choice for routine use.

WordPress backup plugins

If your site runs on WordPress, there are well-known backup plugins such as UpdraftPlus and others, and their features are broadly similar:

• Automatic scheduling for files and the database at different frequencies.
• Sending backups directly to external cloud storage.
• Keeping a set number of backups and deleting older ones automatically.
• Restoring from inside the WordPress dashboard in a few clicks.

Choose a plugin with regular updates and good reviews, and don't run more than one backup plugin at the same time, so you don't waste server resources for no reason.

Where should you store backups off the server?

The off-site copy is the most important part of the 3-2-1 rule. Common options include:

• Cloud storage: Popular file storage services or object storage services. Many backup plugins connect to them directly. The services available to you, and their prices, depend on your country and the payment methods you have access to.
• An encrypted external drive: Download your backups regularly and store them on an encrypted drive that you disconnect from your computer after copying, which keeps it out of reach of ransomware.

Whatever you choose, encrypt your backups or protect them with a strong password, because they contain all your customer data and your database passwords.

Testing restores: an untested backup isn't a backup

Many people discover on the day of a disaster that their backup is incomplete, corrupted, or doesn't contain the database at all. The only way to be sure is to actually try a restore.

Every few months, restore a backup to a test environment: a subdomain such as staging.example.com, or your own computer using a tool like MAMP or XAMPP. Open the site and check that the pages, images, and latest orders are all there.

Steps to restore when you need to

1. Choose the right backup: The last clean backup from before the problem, not necessarily the most recent one.
2. Back up the current state: Even if the site is broken, you may need newer data from it, such as today's orders.
3. Restore the files: From cPanel, from your backup plugin, or by uploading them manually through the File Manager.
4. Restore the database: Through cPanel or phpMyAdmin (Import), and make sure the connection details in your configuration file are correct.
5. Clear the cache: In your caching plugins and in your browser.
6. Test the site: Pages, forms, login, orders, and email.
7. Fix the root cause: If the problem was a hack, change your passwords and update everything before reopening the site, or it will happen again.

Backup schedule template for a small business

Here is a suggested schedule you can adapt to your site:

Frequently asked questions

Aren't my hosting provider's backups enough?

Backup policies vary widely between providers: some take regular backups, others don't guarantee them, and some keep backups for internal use during outages only. Even when they exist, they're stored with the same company that hosts your website. Treat them as an extra layer if they're available, and always keep your own backups outside your hosting.

Is backing up only the database enough?

No. The database holds your text and settings, but your images, attachments, theme, and plugins live in the files. You need both to bring your site back exactly as it was, keeping in mind that the database changes faster and deserves more frequent backups.

How much storage do I need for backups?

It depends on the size of your site and on how many backups you keep, and of which type. Start by finding the size of one full backup, multiply it by the number of full backups you'll keep, and add some headroom for partial backups. Incremental backups save a lot of space on large websites.

Should I store backups in my hosting account?

You can keep a temporary copy there for quick restores, but it eats into your account's storage and won't protect you if the server fails or the account is compromised. Move it to an external location, then delete it from the account once you've confirmed the external copy is intact.

How often should I test restoring a backup?

About every three months at a minimum, and after any major change to how you back up, such as switching plugins or storage locations. A test takes no more than an hour and gives you confidence that your backups will work on the day you need them.

Conclusion

Backing up your website isn't a complicated technical task. It's a regular habit: know what you're backing up, choose a frequency that matches how fast your content changes, follow the 3-2-1 rule with a copy always kept off the server, and test your restores before you need them. Start today with a single full backup stored outside your hosting, then build out your schedule gradually. And if you're looking for hosting with cPanel, NVMe storage, and Arabic-speaking support, take a look at NetNexus hosting plans.