Article Backups & Recovery

The 3-2-1 backup rule, applied to websites

Three copies, on two kinds of storage, with one of them off-site — a decades-old backup rule that maps neatly onto a website.

iFastHosting Support Team Updated 26 August 2026 8 min read Beginner

The 3-2-1 rule is not specific to websites, or even to computing. It comes from general data-protection practice, and the version most often quoted is simple to state and easy to forget under pressure: keep three copies of anything that matters, on two different kinds of storage, with at least one of those copies somewhere other than where the original lives.

It survives because it is built to defeat the specific way backups actually fail — not through bad luck, but through every copy sharing a cause of failure with every other copy.

Why "one backup" is not enough

A single backup answers one question: what if the live site breaks? It does not answer a more common one: what if whatever broke the live site also reaches the backup? A backup stored in the same account as the site it protects is not really a separate copy in any meaningful sense — a suspended account, a compromised set of credentials, or a full disk takes both down together. The rule exists specifically to stop that overlap.

Breaking the rule down for a website

Element	What it means here	Practical example
3 copies	The live site counts as one. You need at least two more that are not it.	Live site, an automated snapshot, and a downloaded archive
2 media types	Not all copies on the same kind of storage, so one failure mode cannot hit both.	A snapshot on the server's storage, plus a copy on a local drive or in cloud storage
1 off-site	At least one copy physically or logically separate from the hosting account.	An archive downloaded to your own machine, or synced to cloud storage under your own account

Put together, a minimal setup that satisfies all three looks like this: the live site itself (copy one), an automated backup taken through your control panel (copy two, second medium in the sense that it is a separate stored snapshot rather than the live files), and a copy of that backup downloaded or synced somewhere you control (copy three, and the off-site one). Miss the third step and you have a good backup habit that still fails the rule, because everything you have is reachable from the same account.

Where the rule most often gets broken

Almost never at step one. Nearly every host, including us, offers some form of automated account backup, and most site owners who back up at all get that far. The rule breaks at step three, because it is the one step that takes actual effort — downloading a file, or setting up a sync — rather than ticking a box.

"My host backs it up" is not the same as "it is backed up"

A host-side backup is a genuinely useful safety net, and worth having. But it typically lives on infrastructure connected to your account, which means it shares that account's fate in exactly the scenarios where you most need a backup to survive: account compromise, a billing problem, or a dispute. Treat it as copy two, not as the whole answer.

Choosing the second medium

"Two different kinds of storage" is about failure independence, not brand names. For a website, reasonable pairings include:

Server storage plus a local drive. An automated backup on the hosting account, downloaded periodically to a computer or an external drive.
Server storage plus cloud storage. The same automated backup, synced instead to a cloud storage account you control, which also protects against your local machine failing.
Local drive plus cloud storage. If you take backups by hand rather than relying on an automated one, keeping a copy on your machine and another synced to the cloud still satisfies two media and one off-site location.

What does not count as a second medium: two automated backups sitting in the same account, or a backup and its own copy sitting in the same folder. Neither survives the failure the rule is designed against.

A practical setup that satisfies 3-2-1

Turn on automated backups
Through the backups section of your control panel, or a plugin if your platform supports one. This is copy two.
Move a copy off the account on a schedule
Download the latest backup periodically, or automate the transfer with a tool such as rclone pushing to cloud storage on a cron job. This is copy three, and the off-site copy. Moving backups off your hosting account covers the mechanics.
Test the off-site copy, not just the on-server one
A copy you have never opened is unverified regardless of where it lives. Periodically confirm the off-site file actually restores, not only that it exists.

What the rule does not cover

3-2-1 tells you how many copies to keep and how to spread the risk between them. It says nothing about whether any individual copy actually works, or about what you do in the hour after something goes wrong — those are separate problems, covered in testing that a backup works and a disaster recovery plan for a small website. The rule is the foundation those build on, not a substitute for them.

None of this needs to be complicated or expensive to satisfy. A single scheduled backup and one automated sync to cloud storage covers all three elements for most small sites, and is a smaller amount of ongoing effort than recreating a site from nothing ever is.