What does 3-2-1 mean?
- 3 copies — Your live data plus two backups. If one fails, you still have two.
- 2 types of storage — Different disks, systems or services, so one fault can’t take them all.
- 1 off-site — At least one copy in a different location, away from the original.
Why is the 3-2-1 rule so widely recommended?
Each part of the rule covers a different risk. Three copies means a single failed backup isn’t the end. Two types of storage means a problem with one kind of system — a faulty batch of disks, a software bug, a provider issue — doesn’t hit every copy at once. One off-site copy means a fire, flood, theft or data center outage can’t destroy your only backups along with the original.
Notice what it protects against: not just hardware failure, but human mistakes and attacks. If someone deletes the wrong folder, or ransomware encrypts your server, the backups that live somewhere else are the ones that save you.
How do you apply the 3-2-1 rule to a website or server?
For a typical business server or website, it might look like this:
- Copy 1 — the live system. Your website, store or business software on its server.
- Copy 2 — a local snapshot. Quick to restore from for everyday mistakes, kept on separate storage from the live data.
- Copy 3 — an off-site backup. Stored with a different provider or in a different region, encrypted, and kept for long enough to catch problems noticed weeks later.
The backups should be automatic. A backup that depends on someone remembering will eventually be missed.
What mistakes break the 3-2-1 rule?
- “Off-site” on the same account — if one login can delete the live server and every backup, a single compromised account can wipe out everything.
- Backups on the same server — convenient, but they disappear when the server does.
- Only one restore point — if the latest backup already contains the problem, you need an older one.
- Forgetting the database — copying website files without the database leaves you with an empty shell.
- No encryption — backups hold all your data, so they deserve the same protection as the live system.
What are 3-2-1-1-0 and immutable backups?
Some teams extend the rule to 3-2-1-1-0: one copy that is offline or immutable (it can’t be changed or deleted for a set time, even by an administrator), and zero errors when backups are checked. Immutable copies matter because some attacks try to delete backups before encrypting the live system. If your provider supports locked or versioned storage, it’s worth using for at least one copy.
Is following 3-2-1 enough?
Not on its own. The rule tells you where to keep copies; it doesn’t prove you can restore them. You also need to know:
- How often backups run — the gap is how much work you could lose.
- How long they’re kept — some problems surface late.
- How long a restore takes — and who knows how to do it.
- That it actually works — by testing a restore regularly.
Our guide on how to check your backups actually work walks through a simple restore test.
How we handle backups
Sites on our web hosting get automatic off-site backups. For servers and business systems, our backup and disaster recovery service sets up off-site, encrypted backups and a tested plan to get you running again.
Questions we get asked
Does cloud storage count as off-site?
Yes, as long as it’s separate from where your live data runs — ideally a different provider or region, so one outage can’t affect both.
Is RAID a backup?
No. RAID protects against a disk failing, but if a file is deleted or encrypted, RAID copies that change instantly. You still need separate backups.
Is the 3-2-1 rule still relevant today?
Yes. The storage has changed, but the principle — several copies, different systems, one far away — still covers the most common ways data is lost.
How often should I back up?
As often as you can afford to lose work. A busy store or ERP needs far more frequent backups than a brochure site that rarely changes.
Something else on your mind? Ask us directly →
