3-2-1 Backup Rule
The 3-2-1 backup rule means keeping three copies of your data on two different types of storage, with one copy off-site. For a WordPress site that is the live server, a scheduled backup on separate storage, and a third copy somewhere the hosting account cannot reach. The 3-2-1-1-0 update adds an immutable copy and a tested restore.
knowledge
- Read time
- 4 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What does the 3-2-1 backup rule mean?
The 3-2-1 backup rule means keeping three copies of your data, on two different types of storage, with one copy off-site. The live data counts as the first copy, so in practice you keep two backups, and one of them lives outside your building and outside your hosting account.
| Digit | Requirement | Why | Does not count |
|---|---|---|---|
| 3 | Three copies: production plus two backups | One failure never leaves you with a single copy | A backup you overwrite with the same corrupted data |
| 2 | Two different media or storage systems | Independent failure, e.g. server disk and cloud object storage | Two folders on the same disk |
| 1 | One copy off-site | Survives fire, theft, a closed account or a host-wide incident | A second folder on the same hosting account |
The rule is commonly credited to photographer Peter Krogh's work on digital asset management and has since become standard advice for any data.
How does the 3-2-1 rule apply to a WordPress site?
For WordPress, each copy must contain both halves of the site, the database and the files under public_html, and at least one copy must sit where the live account cannot delete it. A files-only copy restores a site with no content; a database-only copy restores posts with missing images.
A backup plugin that saves into public_html fails the test, as does a staging clone on the same server or a sync folder that mirrors deletions. A schedule that suits most sites is database daily, files weekly and a full off-site export monthly; a store taking orders should not go a day without a database copy. How often each type of site needs backing up is covered in how often to back up a website.
What does a 3-2-1 setup look like for a small WooCommerce store?
A practical example: the live site on the host, a scheduled backup in a remote vault the hosting account cannot erase, and a weekly export on an encrypted drive kept at the owner's home.
- Copy 1, live: WordPress files and the MySQL database on the hosting account.
- Copy 2, remote vault: daily files-and-database backup sent to separate backup storage.
- Copy 3, off-site and offline: a weekly full archive and database dump on an encrypted external drive.
That is three copies on two systems with one off-site. If the hosting account is suspended or the drive is stolen, one copy still survives. With SSH, the export half can be scripted and pushed to cloud storage with rclone:
wp db export - | gzip > ~/backups/db-$(date +%F).sql.gz
tar -czf ~/backups/files-$(date +%F).tar.gz -C ~/public_html .
rclone copy ~/backups remote:site-backupsKeep the ~/backups folder outside public_html so archives cannot be downloaded from the web.
What is the 3-2-1-1-0 backup rule?
3-2-1-1-0 keeps the original three copies and adds two conditions: one immutable or air-gapped copy, and zero errors, meaning a restore has been tested. Ransomware now looks for backups before it encrypts production, so a copy an attacker cannot change is the one that saves you.
- Immutable: object storage under a retention lock, so nothing can alter or delete a file for a set period, not even the account that wrote it.
- Air-gapped: offline or unreachable except while it is being written, such as a drive disconnected after each backup.
- Zero errors: a backup nobody has opened is a guess; one test restore a quarter turns it into a fact.
Incremental schedules reduce storage for these extra copies; the trade-offs are in incremental vs full backups.
How do you prove your backup copies actually work?
Restore one archive a month to a staging site and check that the import finishes cleanly, the home page loads, a recent upload opens and the error log stays empty. Rotate which copy you test, because the one you never open is the one that will fail.
The cPanel and phpMyAdmin steps are in the WordPress restore walkthrough, and plugins that write backups off the server are compared in WordPress backup plugins.
How can WebJi® cover the off-site copy?
WebJi® sells the remote copy and the restore, not the rule itself: Backup.Help with 200 GB of automatic backup storage is ₹1,300 a month before 18% GST, per WebJi®'s published pricing. Checkout confirms the current price.
Server-level plans are under server backup solutions, and a WordPress site can use the WordPress backup service instead of a plugin. Whichever route you choose, keep one copy you control yourself, because a provider's vault is still a single system. Email support@webji.services to have a plan's retention window checked before you rely on it.
Frequently asked questions
Does my host's daily backup count as a 3-2-1 copy?
It counts as one backup if it is stored on separate backup infrastructure, but it is not your off-site copy if you cannot download it or it shares the provider's account. Keep a third copy you control, such as a monthly export on your own cloud storage or drive.
Is Google Drive a valid off-site copy?
Yes, if backups are uploaded there rather than synced from the server, and the Google account has two-factor login. A two-way sync folder copies deletions and encryption from the source, so it does not protect against ransomware.
Is 3-2-1 still enough in 2026?
It is the baseline, not the finish line. Because attackers target backups first, a modern plan adds one copy that cannot be changed and a restore that has been tested, which is what the 3-2-1-1-0 version spells out.
How long should I keep old backups?
Long enough to go back before a problem started. Malware often sits unnoticed for weeks, so keep at least 30 days of daily copies plus monthly archives for several months. Stores with GST records may need longer retention for invoices and orders.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.