Backups done right, the 3-2-1 rule for your website and business data
Why a backup on the same server is not a backup, how the 3-2-1 rule works and how to protect your website, email and business data with little effort.
A hard drive fails, an update breaks the website, ransomware encrypts every file, or someone accidentally deletes the wrong folder. That is when you find out whether there is a usable backup. Many small businesses only discover at that moment that their backup is incomplete, outdated or damaged itself.
The 3-2-1 rule
The proven rule of thumb for backups is:
- 3 copies of your data: the original and two backups.
- 2 different types of storage, for example an external hard drive and cloud storage.
- 1 copy off-site, meaning not in the same building and not on the same server.
The reason: a fire, a burglary or ransomware hits everything in the same place or on the same network. A copy that lives elsewhere and is not permanently connected survives that too.
What needs to be backed up
Website: both the files (images, theme, plugins, uploads) and the database. In WordPress, all of your content lives in the database. A backup of just the files is of little use.
Email: even with providers such as Microsoft 365 or Google Workspace, you are largely responsible for backing up your own data. Deleted emails are gone for good once the retention period has passed.
Business data: accounting, customer data, contracts, photos, project files. Also think of data that only lives on individual laptops.
Login details: export your password manager’s data in encrypted form, and keep recovery codes for important accounts separately.
The most common backup mistakes
- The backup sits on the same server. Many hosts and plugins store backups in the same web space. If the server fails or is hacked, the backup is gone too.
- The external drive is permanently plugged into the computer. Ransomware encrypts it along with everything else. Only plug it in to back up, or use storage with versioning.
- Nobody has ever tested a restore. A backup that cannot be restored is not a backup. Try it at least once a year.
- The backup has stopped running. After a move or an update, automatic backups often break silently. Get notified about errors.
- There is only the latest version. If an error is only noticed after a week, the daily backup has already been overwritten. Keep several older versions.
A simple plan for small businesses
| What | How often | Where to |
|---|---|---|
| Website (files and database) | daily, automatic | your host’s backup plus an external storage location |
| Business data on computers | daily, automatic | encrypted cloud storage with versioning |
| Full backup | weekly or monthly | external hard drive, unplugged afterwards |
| daily, automatic | a backup service for your email provider |
What to look for in a cloud backup
- End-to-end encryption: your data is encrypted on your device before it is uploaded. The provider cannot read it.
- Versioning: older versions of a file are kept. If a file is encrypted or overwritten, you restore the previous version.
- Server location: for business data containing personal information, a provider with servers in the EU or Switzerland usually makes things simpler under the GDPR.
- Restoring: check beforehand how easily you can restore individual files and entire folders.
The test: what would happen tomorrow?
Imagine your laptop is stolen today and your web server fails at the same time. How long would it take until you can work again, and which data would be lost? If the answer makes you uncomfortable, start today with an automatic backup of the most important things. The rest can follow step by step.
You will find further protective measures in the website security checklist for small businesses.