{
    "title": "3-2-1 backup rule",
    "seo_title": "3-2-1 backup rule: definition and use with WordPress",
    "h1": "3-2-1 backup rule",
    "description": "The 3-2-1 backup rule: three copies, two types of media, one offsite. What the rule says, what CISA and ANSSI add, and how to apply it to WordPress.",
    "lead": "The 3-2-1 backup rule means keeping three copies of your data (the original and two backups), on two different types of media, with one copy stored offsite. It keeps a single failure, mistake, fire or ransomware attack from wiping out the site and all of its backups at the same time.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/",
    "canonical": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/",
    "markdown": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/index.md",
    "json": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-28T20:11:49+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "3-2-1 backup rule",
            "url": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/",
            "markdown": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/index.md",
            "json": "https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Sauvegarde 3-2-1",
            "url": "https://www.wp-masquerade.com/fr/definitions/sauvegarde-3-2-1/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/sauvegarde-3-2-1/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/sauvegarde-3-2-1/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Regla de copias 3-2-1",
            "url": "https://www.wp-masquerade.com/es/glosario/regla-3-2-1/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/regla-3-2-1/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/regla-3-2-1/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "3-2-1-Backup-Regel",
            "url": "https://www.wp-masquerade.com/de/glossar/3-2-1-backup-regel/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/3-2-1-backup-regel/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/3-2-1-backup-regel/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Regola del backup 3-2-1",
            "url": "https://www.wp-masquerade.com/it/glossario/backup-3-2-1/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/backup-3-2-1/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/backup-3-2-1/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Regra de backup 3-2-1",
            "url": "https://www.wp-masquerade.com/pt/glossario/regra-de-backup-3-2-1/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/regra-de-backup-3-2-1/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/regra-de-backup-3-2-1/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "3-2-1-back-upregel",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/3-2-1-back-upregel/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/3-2-1-back-upregel/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/3-2-1-back-upregel/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "3-2-1 backup rule"
        },
        {
            "level": 2,
            "text": "The three numbers"
        },
        {
            "level": 2,
            "text": "What recent guidance adds"
        },
        {
            "level": 2,
            "text": "For WordPress"
        },
        {
            "level": 2,
            "text": "Common mistakes"
        }
    ],
    "body": "A single backup stored on the same server as the site protects you from almost nothing: a disk failure, a slip of the hand, a closed account or a hack takes it down along with the original. The 3-2-1 rule spreads the risk. CISA, the US cybersecurity agency, puts it this way in a guide aimed at both home users and businesses: keep three copies of any important file, one primary and two backups; on two different types of media; with one copy stored offsite.\n\n## The three numbers\n\n- **3 copies**: two independent backups, so that one corrupted backup doesn't leave you with nothing.\n- **2 types of media**: storage or services of different kinds, which won't fail for the same reason.\n- **1 offsite copy**: far from the server, to survive a fire, an account shutdown or a compromised hosting account.\n\n![Diagram of the 3-2-1 rule applied to a WordPress site. Three copies: the live site and two backups. Two types of media: for example the host's backups and object storage or an external drive. One offsite copy: with another provider, with no write access from the server, ideally offline or immutable. Finally, a regular restore test.](https://www.wp-masquerade.com/media/2026/10/regle-3-2-1-en-1.webp)\n\n*Three copies, two types of media, one offsite: plus a tested restore, without which a backup is just a hope.*\n\n## What recent guidance adds\n\nThe backup fundamentals guide from ANSSI, the French national cybersecurity agency, goes further, with two points that matter against [ransomware](https://www.wp-masquerade.com/glossary/ransomware/). First, an offline backup on a disconnected medium is considered essential, or at least an online offsite copy under strict conditions, even if it runs less often than routine backups. Second, backups must be tested regularly, with a written restore procedure. The guide also points out that after an incident, a backup may contain compromised elements: check what you are restoring.\n\nSome vendors talk about 3-2-1-1-0: one more copy that is immutable or offline, and zero errors found during restore tests. The idea stays the same.\n\n*Video: “Data Backup: The 3-2-1 Rule” (ExplainingComputers)*\n\n## For WordPress\n\nA WordPress backup has two parts: the files (mainly wp-content and wp-config.php) and the database. Our guide to [a 3-2-1 strategy that holds up](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/) covers the setup in detail; in short:\n\n- **Copy 1**: the host's automatic backups, handy for a quick restore, but tied to the account.\n- **Copy 2**: a backup plugin or a [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/) script (`wp db export` for the database, plus an archive of the files) sent to external storage.\n- **Offsite and protected**: the server should be able to upload backups, not delete them. An attacker who controls the site must not be able to wipe the history.\n- **Frequency**: matched to how much you can afford to lose. A store that takes orders every hour can't settle for a weekly backup.\n- **Testing**: restore to a [staging site](https://www.wp-masquerade.com/glossary/staging-environment/) from time to time, and time how long it takes.\n\n## Common mistakes\n\nKeeping archives in a public folder of the site, where they use up [inodes](https://www.wp-masquerade.com/glossary/inodes/) and anyone can download them; backing up only the database or only the files; never having tried a restore; restoring, after a hack, a backup that already contained the backdoor. Our procedure to [clean up a hacked site](https://www.wp-masquerade.com/clean-hacked-wordpress-site/) explains how to pick the right restore point.\n\n## Related terms\n\n- [Ransomware](https://www.wp-masquerade.com/glossary/ransomware/)\n- [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/)\n- [Staging environment](https://www.wp-masquerade.com/glossary/staging-environment/)\n- [Inodes](https://www.wp-masquerade.com/glossary/inodes/)\n- [Uptime and SLA](https://www.wp-masquerade.com/glossary/uptime-sla/)\n\n\n## Sources\n\n- [CISA (US-CERT): Data Backup Options](https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf)\n- [NCSC: Backing up your data](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data)\n- [WP-CLI Commands: wp db export](https://developer.wordpress.org/cli/commands/db/export/)",
    "definition": "The 3-2-1 backup rule means keeping three copies of your data (the original and two backups), on two different types of media, with one copy stored offsite. It keeps a single failure, mistake, fire or ransomware attack from wiping out the site and all of its backups at the same time.",
    "group": "Web hosting",
    "aka": [
        "3-2-1 rule",
        "3-2-1 backup strategy",
        "3-2-1 backup",
        "offsite backup",
        "offline backup"
    ],
    "related": [
        {
            "title": "Ransomware",
            "url": "https://www.wp-masquerade.com/glossary/ransomware/",
            "markdown": "https://www.wp-masquerade.com/glossary/ransomware/index.md"
        },
        {
            "title": "WP-CLI",
            "url": "https://www.wp-masquerade.com/glossary/wp-cli/",
            "markdown": "https://www.wp-masquerade.com/glossary/wp-cli/index.md"
        },
        {
            "title": "Staging environment",
            "url": "https://www.wp-masquerade.com/glossary/staging-environment/",
            "markdown": "https://www.wp-masquerade.com/glossary/staging-environment/index.md"
        },
        {
            "title": "Inodes",
            "url": "https://www.wp-masquerade.com/glossary/inodes/",
            "markdown": "https://www.wp-masquerade.com/glossary/inodes/index.md"
        },
        {
            "title": "Uptime and SLA",
            "url": "https://www.wp-masquerade.com/glossary/uptime-sla/",
            "markdown": "https://www.wp-masquerade.com/glossary/uptime-sla/index.md"
        }
    ],
    "sources": [
        {
            "title": "CISA (US-CERT): Data Backup Options",
            "url": "https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf"
        },
        {
            "title": "NCSC: Backing up your data",
            "url": "https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data"
        },
        {
            "title": "WP-CLI Commands: wp db export",
            "url": "https://developer.wordpress.org/cli/commands/db/export/"
        }
    ],
    "format": "application/json"
}