Website backup: what to save, how often and where (the 3-2-1 rule)

You always remember the backup twice: the first time when someone recommends it, the second when you need it and it is not there. An update that breaks the site, an attack, human error, a hosting failure: in all these cases, the difference between an hour of annoyance and a week of disaster lies in a recent, working copy.

In this guide I explain what to save, how often and where, and why "having a backup" is not enough: you must know it can be restored.

Why you need it, even if it "never happens"

The causes of data loss are many and more banal than you might think.

• Updates that break a feature or the layout.
• Cyber attacks that alter or delete files and database. I talk about it in Hacked WordPress site: what to do right away.
• Human errors: a deleted page, a removed plugin, an overwritten file.
• Failures or problems with the hosting provider.
• Forgotten expiries of services or subscriptions.

What to save

A site is made of several parts, and a good backup includes them all.

• The files: theme, plugins, uploaded images and documents, configuration files.
• The database: text, pages, settings, users, orders, forms received. In a dynamic site it is the most precious part and the one that changes most often.
• The server configuration: settings, program versions, DNS records, particular rules.
• Access and credentials kept securely, because without them nothing can be restored.
• The emails, if the mail lives on the same service.

How often

Frequency depends on how much the site changes and how much you can afford to lose.

• Showcase site that rarely changes: weekly backup, and one before every intervention.
• Site with frequent articles and updates: daily.
• Online shop or site with orders and sign-ups: daily for files, and the database more often, because every lost order is real damage.

A useful question: if I had to restart from the last copy, how many hours of work and orders would I lose? If the answer is too high, the frequency should go up.

Where to keep it: the 3-2-1 rule

The best-known rule is simple and works.

• 3 copies of the data: the original plus two backups.
• 2 different media: for example the server and an external archive.
• 1 copy off-site: somewhere other than the server and the site's provider.

The practical consequence: a backup that sits on the same server that breaks is not a real backup. If hosting, site and copy depend on the same account, a single problem takes them all away.

It is also worth:

• encrypting the copies, because they contain personal data;
• limiting access to those who need it;
• keeping several versions over time, not just the latest: sometimes a problem is discovered days later.

Backup, snapshot and versions: differences

Different words are used for similar things.

• Backup: a copy of the data, kept separately.
• Snapshot: an instant photograph of a server or disk, useful for going back quickly but generally on the same system.
• Code versions: the history of changes (for example in Git), which protects the code but not the content in the database.

They are complementary tools, not alternatives.

Restoring: the part that gets forgotten

A backup is only useful if it is restored. So:

• test it at regular intervals, on a copy of the site, not on the live one;
• note the steps and timing: how long does it take to get back online?
• check that it is complete: pages, images, orders, forms, features;
• know who does it: who has the permissions and skills, and how they are contacted in an emergency.

A backup never restored is a hope, not a guarantee.

Backing up a WordPress site: two ways

• From the hosting service: it often offers automatic copies. It is convenient, but it is worth checking frequency, retention and restore method, and not relying on them alone.
• With a plugin or dedicated tool: it saves files and database and sends them to an external location. It has to be configured with care (frequency, destination, encryption) and checked.

In both cases, the right system is the one you can really restore. The matter is part of maintenance work.

Common mistakes

• A single backup, on the same server.
• No restore test.
• Keeping only the latest copy, which may already contain the problem.
• Forgetting the database, or saving only the files.
• Backups never checked that turn out to be empty or incomplete.
• Nobody knows who manages them or where they are.

A minimal plan in five steps

If today you have nothing organised, start here.

1. Check what your hosting already has (frequency, retention, restore method).
2. Add an off-site copy, automatic, somewhere other than the server.
3. Set the frequency based on how much the site changes and how much you can afford to lose.
4. Try a restore on a copy of the site and note how long it takes.
5. Write who does what in an emergency, with contacts and where the access details are.

It is a few hours of work, worth more than any regret.

Why entrust it to me

I have been programming since 1999, with more than 300 projects delivered and about 30 agencies as an external developer. I handle backup, security and recovery: automatic backups at several locations, security updates, access control and, above all, tested restores, because a backup that cannot be restored is useless. I work from Rome and remotely.

If you want to know whether your site is really safe, write to me: a chat of about 20 minutes, no strings attached, then a written, free proposal. The service is in Hosting, servers and cloud infrastructure.