A single backup stored on the same server as the site protects you from almost nothing: a disk failure, a slip of the hand, a closed account or a hack takes it down along with the original. The 3-2-1 rule spreads the risk. CISA, the US cybersecurity agency, puts it this way in a guide aimed at both home users and businesses: keep three copies of any important file, one primary and two backups; on two different types of media; with one copy stored offsite.
The three numbers
- 3 copies: two independent backups, so that one corrupted backup doesn't leave you with nothing.
- 2 types of media: storage or services of different kinds, which won't fail for the same reason.
- 1 offsite copy: far from the server, to survive a fire, an account shutdown or a compromised hosting account.
What recent guidance adds
The backup fundamentals guide from ANSSI, the French national cybersecurity agency, goes further, with two points that matter against ransomware. First, an offline backup on a disconnected medium is considered essential, or at least an online offsite copy under strict conditions, even if it runs less often than routine backups. Second, backups must be tested regularly, with a written restore procedure. The guide also points out that after an incident, a backup may contain compromised elements: check what you are restoring.
Some vendors talk about 3-2-1-1-0: one more copy that is immutable or offline, and zero errors found during restore tests. The idea stays the same.
For WordPress
A WordPress backup has two parts: the files (mainly wp-content and wp-config.php) and the database. Our guide to a 3-2-1 strategy that holds up covers the setup in detail; in short:
- Copy 1: the host's automatic backups, handy for a quick restore, but tied to the account.
- Copy 2: a backup plugin or a WP-CLI script (
wp db exportfor the database, plus an archive of the files) sent to external storage. - Offsite and protected: the server should be able to upload backups, not delete them. An attacker who controls the site must not be able to wipe the history.
- Frequency: matched to how much you can afford to lose. A store that takes orders every hour can't settle for a weekly backup.
- Testing: restore to a staging site from time to time, and time how long it takes.
Common mistakes
Keeping archives in a public folder of the site, where they use up inodes and anyone can download them; backing up only the database or only the files; never having tried a restore; restoring, after a hack, a backup that already contained the backdoor. Our procedure to clean up a hacked site explains how to pick the right restore point.